# Elasticsearch leaks data through the notes scope

GitLab's Elasticsearch notes-scope search returned private issue/group/project metadata to users lacking access, leaking existence and membership details.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: rpadovani
- Disclosed: 2020-10-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/710006
- Library page: https://bugbountylibrary.com/r/h1%3A710006
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:elasticsearch technique:recon vuln:access-control vuln:info-disclosure

**Target:** GitLab.com search (Elasticsearch-backed, scope=notes) and /api/v4/projects/:id/search
**Root cause:** Elasticsearch-backed notes search results were not filtered by the searcher's authorization on the noteable's project/group, so notes referencing private issues were returned.
**Steps:**
1. As anonymous, browse `https://gitlab.com/search?group_id=9970&scope=notes&search=nextbit` and observe a private note result.
2. As a logged-in user without access to `nextbit`, call `curl "https://gitlab.com/api/v4/projects/278964/search?scope=notes&search=nextbit" --header "PRIVATE-TOKEN: TEST"`.
3. Observe returned note body `mentioned in issue nextbit/VirtualCore/gui#109` with author, noteable_id, noteable_iid, noteable_type.
**How found:** Researcher searched a known term (`nextbit`) with the notes scope and noticed a private note surfaced, then confirmed via API with an unrelated account's token.
**Exploitation:** Attacker supplies a search term (e.g. a known username or project name) with scope=notes via web or API; Elasticsearch returns notes from private projects/groups the attacker cannot access, disclosing existence, IDs, and membership.
**Insight:** Search backends (Elasticsearch) often apply authorization only to the primary document, not to joined/related objects like notes; test scope filters that traverse to noteable's parent project for missing ACL checks.