GitLab disclosed a bug submitted by otoyyy: https://hackerone.com/reports/1643962 – Bounty: $100 [Source]