GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 12.6.0 (including) | 12.7.8 (excluding) |
| Gitlab | Gitlab | 12.8.0 (including) | 12.8.8 (excluding) |
| Gitlab | Gitlab | 12.9.0 (including) | 12.9.1 (excluding) |
| Gitlab | Ubuntu | esm-apps/xenial | * |
| Gitlab | Ubuntu | xenial | * |