# Container scanning and Dependency scanning report leaked to unauthorized users

GitLab merge request container/dependency scanning report endpoints lacked CI permission checks, leaking vulnerability scan results of public projects to unauthorized users.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: xanbanx
- Disclosed: 2019-12-13
- CVE: CVE-2019-15591, CVE-2017-18269, CVE-2017-16997, CVE-2018-1000001, CVE-2016-10228, CVE-2018-18520, CVE-2010-4052, CVE-2018-16869, CVE-2018-18311, CVE-2014-3488, CVE-2017-12794, CVE-2018-1000201
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/676976
- Library page: https://bugbountylibrary.com/r/h1%3A676976
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:ci-cd vuln:access-control vuln:info-disclosure

**Target:** GitLab merge request scanning report JSON endpoints (container_scanning_reports, dependency_scanning_reports)
**Root cause:** The merge request scanning report endpoints render CI job artifacts without verifying the requesting user has CI/pipeline access, so public projects with public pipelines disabled still expose the reports.
**Steps:**
1. Create a public project, restrict CI pipeline access to project members, disable public pipelines.
2. Push a branch with .gitlab-ci.yml producing container_scanning and dependency_scanning report artifacts.
3. Create a merge request with those changes.
4. As an unauthorized user, GET `/<namespace>/<project>/merge_requests/1/merge_requests/1/container_scanning_reports` and `.../dependency_scanning_reports`.
**How found:** Noticed scanning reports are CI job outputs gated by CI permission, then tested whether the merge request report endpoints enforce that same permission on a project with public pipelines disabled.
**Exploitation:** Any unauthenticated/unauthorized user of a public project fetches the report endpoints directly and reads the full vulnerability scan output (CVEs, packages, versions) despite lacking CI access.
**Insight:** When a feature is gated by a permission (CI access), check every separate endpoint that renders its artifacts — merge request widgets/JSON report endpoints often re-implement access control and miss the gate.