GitLab disclosed a bug submitted by yvvdwf: https://hackerone.com/reports/1693150 – Bounty: $13950 [Source]