GitLab: State filter in IssuableFinder allows attacker to delete all issues and merge requests

Vulnerability details The state filter in the IssuableFinder class has the ability to filter issues and merge requests by state. This filter is implemented by calling publicsend with unfiltered user input. This allows an attacker to call deleteall or destroyall. Because the method is called befor...