description: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
problem types: Insecure Direct Object Reference (IDOR) (CWE-639)
affected:
{
product: GitLab CE/EE
vendor: n/a
versions:
status: affected, version: Affects GitLab CE/EE 11.5 and later
status: affected, version: Fixed in 12.1.2 in 12.0.4 and in 11.11.6
}