Able to leak private email of any user given his/her username via graphql

HackerOne report #972355 by vaib25vicky on 2020-09-01, assigned to @rchan-gitlab:

Report | How To Reproduce

Report

Summary

Graphql query user is leaking private email of users

query {  
  user(username:"<victim>"){  
    email  
    username  
  }  
}

Steps to reproduce

(Step-by-step guide to reproduce the issue, including:)

• Have a account with private email settings
• Use graphql query to access the private email

query {  
  user(username:"<victim>"){  
    email  
    username  
  }  
}

• Done

Impact

Leaks private emails of users by just knowing their usernames. Attacker can use this bug for mass leakage of gitlab users private emails.

How To Reproduce

Please add reproducibility information to this section: