# Group search with Elastic search enable leaks unrelated data

GitLab group search with Elasticsearch enabled returned merge requests, issues and activity from unrelated private groups, leaking their existence and metadata.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: rpadovani
- Disclosed: 2019-12-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/708820
- Library page: https://bugbountylibrary.com/r/h1%3A708820
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:elasticsearch vuln:access-control vuln:info-disclosure

**Target:** GitLab group search (UI and API) backed by Elasticsearch
**Root cause:** Elasticsearch-backed group search does not correctly scope results to the requested group, so documents from other (private) groups match and are returned.
**Steps:**
1. Enable Elasticsearch on the GitLab instance.
2. Open a group search URL such as `https://gitlab.com/search?utf8=%E2%9C%93&snippets=&scope=merge_requests&repository_ref=&search=%21435&group_id=9970`.
3. Observe merge requests from unrelated private groups at the end of the results page.
4. Repeat via the API to retrieve more metadata, and try other `!<number>` queries (e.g. `!709`, `!999`).
5. Search `nextbit` with `scope=notes` to see private issue activity linked to a public issue.
**How found:** Researcher ran a group search for `!435` and noticed MRs from unknown private groups at the bottom of results, then probed other `!<number>` terms and the API to confirm broader leakage.
**Exploitation:** An authenticated user issues group-scoped search queries (UI or API) with terms like `!435`; the backend returns matching MRs/notes from groups the user has no access to, exposing private group existence, MR metadata and private issue activity.
**Insight:** When search is backed by an external index (Elasticsearch), test group/project-scoped queries with cross-cutting tokens like `!<iid>` and check whether results are filtered by the caller's authorization or only by the index query.