# GraphQL query "namespace" leaks data

GitLab GraphQL namespace query returned private profile and private group metadata (description, projects) to unauthenticated users, bypassing REST API access controls.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: rpadovani
- Disclosed: 2019-12-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/614355
- Library page: https://bugbountylibrary.com/r/h1%3A614355
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:info-disclosure

**Target:** GraphQL API endpoint /api/graphql namespace query
**Root cause:** The GraphQL namespace resolver did not enforce the same visibility/authorization checks as the REST API, returning fields like description and projects for private namespaces to unauthenticated callers.
**Steps:**
1. Confirm private profile: https://gitlab.com/rpadovani shows no projects; REST `GET /api/v4/namespaces/16048` with another user's token returns `{"message":"404 Namespace Not Found"}`.
2. Send unauthenticated GraphQL request: `curl 'https://gitlab.com/api/graphql' -H 'Content-Type: application/json' --data '{"query":"{namespace(fullPath:\"rpadovani\") {description requestAccessEnabled fullName fullPath id lfsEnabled name path visibility projects (includeSubgroups: true, ) {edges {node {id name archived visibility description}}}}}"}'`.
3. Observe response returns fullName, visibility, and project list despite private profile.
4. Repeat against private group `secret-group-213` with same query; response leaks `description: "This description is secret!"` and visibility private.
**How found:** Researcher compared access controls across interfaces: private profile blocked in web UI and REST API (404), then tested whether the newer GraphQL implementation enforced the same checks and found it did not.
**Exploitation:** Unauthenticated attacker enumerates namespace fullPaths and queries the GraphQL namespace field to harvest private profile data, private group descriptions, and project metadata that REST API and web UI deny.
**Insight:** When a product ships a second API surface (GraphQL) alongside a mature one, test the same object/field through the new surface unauthenticated — authorization logic is often reimplemented and misses visibility checks present in the old API.