CVE-2020-13270 (NVD)

2020-06-10

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API

Products Gitlab
Type Missing Authorization (CWE-862)
First patch - None (likely due to unavailable code)
Links • https://gitlab.com/gitlab-org/gitlab/-/issues/24648
• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13270.json
• https://hackerone.com/reports/419977