# Private System Note Disclosure using GraphQL

GitLab GraphQL issue notes exposed private system notes (moved project, duplicate-of confidential issue, confidential mentions) that REST/UI correctly hide from non-members.

- Payout: hidden
- Severity: low
- Program: GitLab
- Found by: ngalog
- Disclosed: 2019-12-13
- CVE: CVE-2019-15576
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/633001
- Library page: https://bugbountylibrary.com/r/h1%3A633001
- Tags: area:web domain:api domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:graphql technique:source-review vuln:access-control vuln:info-disclosure

**Target:** GraphQL API issue notes resolver
**Root cause:** The GraphQL notes resolver returns system notes without applying the same visibility filtering used by REST/UI, so notes referencing private/confidential resources leak to unauthenticated viewers.
**Steps:**
1. Open a private browser with no authenticated session.
2. Visit `https://gitlab.com/-/graphql-explorer`.
3. Send query: `query { project(fullPath:"username16/ci-test"){ issue(iid:"1"){ descriptionHtml notes{ edges{ node{ bodyHtml system author{ username } body } } } } } }`.
4. Observe system notes revealing the issue was moved to dynamic#1, marked duplicate of confidential #2, and mentioned in confidential #2 — none visible in UI.
**How found:** Compared REST/UI output (which hides private system notes) against GraphQL response for the same public issue and noticed the discrepancy.
**Exploitation:** Unauthenticated attacker queries the public GraphQL endpoint for a public issue's notes and reads system notes referencing private projects/confidential issues, leaking titles/IDs and activity.
**Insight:** When a product has parallel REST and GraphQL surfaces, diff their responses for the same object — authorization filters applied in one resolver are often missing in the other.