# Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result

Transferring a public group into a private group leaves its projects' code and wiki blobs searchable via Elasticsearch-backed search APIs, leaking now-private content.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: rpadovani
- Disclosed: 2020-10-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/748375
- Library page: https://bugbountylibrary.com/r/h1%3A748375
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:elasticsearch technique:source-review vuln:access-control vuln:info-disclosure

**Target:** GitLab instance-wide search API (blobs/wiki_blobs) backed by Elasticsearch
**Root cause:** Group transfer to a private parent does not trigger re-indexing/removal of the projects' blobs from the Elasticsearch index, so stale public-visibility documents remain queryable.
**Steps:**
1. Create public group 'Example' with public project 'Example-project' containing readme text 'Example'.
2. Create private group 'private' and transfer group 'Example' into it.
3. As unrelated user Bob, instance-wide UI search for 'Example' shows count 1 but no visible result.
4. Query `GET /api/v4/search?search=password&scope=blobs` (and `scope=wiki_blobs`) to retrieve now-private code/wiki content.
**How found:** Noticed UI search result count of 1 with no displayed result after transfer, then queried the search API directly to confirm the stale indexed content was still returned.
**Exploitation:** Any authenticated user queries the search API with scope=blobs or wiki_blobs and reads content from projects that were made private via group transfer, bypassing the intended visibility restriction.
**Insight:** When access-control changes rely on async re-indexing, test the search/index API directly rather than the UI: the UI filters results post-query while the API may return raw indexed docs. Group-level bulk operations often skip per-project reindex hooks that single-project moves trigger.