GitLab disclosed a bug submitted by vakzz: https://hackerone.com/reports/1679624 – Bounty: $33510 [Source]