In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 10.5.0 (including) | 12.3.8 (including) |
| Gitlab | Gitlab | 12.4.0 (including) | 12.4.5 (including) |
| Gitlab | Gitlab | 12.5.0 (including) | 12.5.3 (including) |