GitLab disclosed a bug submitted by vakzz: https://hackerone.com/reports/1731349 – Bounty: $13950 [Source]