Skip to content

Release titles visible for any users if group milestones are associated with any project releases

HackerOne report #1012659 by ashish_r_padelkar on 2020-10-20, assigned to @ankelly:

Report

Report

Summary

Hello,

Looks like this issue appeared because of https://gitlab.com/gitlab-org/gitlab/-/issues/235391

When public group milestones are associated with private project releases, the release titles are visible for any user (non members)

Steps to reproduce
  1. Create a public group and milestone in a group. note this group must have gold tier subscription
  2. Create a private project and release within it.
  3. Associate group milestone with private project release with below API
curl --header 'Content-Type: application/json' --request PUT --data '{"name": "RELEASE FROM PROJECT", "milestones": ["GroupMilestone1"]}' --header "PRIVATE-TOKEN: <Token>" "https://gitlab.com/api/v4/projects/<ID>/releases/<Name>"
  1. Now login as any user and access the public group milestone page https://gitlab.com/groups/<PublicGroup>/-/milestones and you should see the name of the release with milestone name. This release actually belongs to private project which you cant see or have access!
What is the current bug behavior?

Release titles visible in public group if the releases are associated with public group milestones!

What is the expected correct behavior?

Release titles shouldnt be visible when they belong to private project!

Output of checks

This bug happens on GitLab.com

Regards,
Ashish

Impact

Release titles visible for any users if public group milestones are associated with any private project releases

Edited by Andrew Kelly