Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles subgroup permissions. An attacker can exploit this vulnerability to gain access to the members list of a parent group, even if they are only a member of the subgroup. This can be used to gain access to sensitive information about the parent group, or to impersonate members of the parent group.