# Unauthorized user is able to access schedule pipeline variables and values

GitLab pipeline schedules API exposed custom variable values to any authenticated user, bypassing the intended owner/maintainer-only read restriction.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by (vendor credit): @vaib25vicky
- Found by: vaib25vicky
- Disclosed: 2020-11-30
- CVE: CVE-2020-13351
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/962462
- Library page: https://bugbountylibrary.com/r/h1%3A962462
- Tags: area:web domain:api domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:info-disclosure

**Target:** GitLab REST API pipeline_schedules endpoint
**Root cause:** The GET single pipeline schedule API serialized custom variables including values without enforcing the documented security model that only schedule owners/maintainers may read them.
**Steps:**
1. Create a project with a pipeline schedule containing custom variables.
2. Note that only owner/maintainer can read variables via UI.
3. As a second/unrelated account, call `curl --header "Private-Token: <token>" https://gitlab.com/api/v4/projects/<id>/pipeline_schedules/<schedule_id>`
4. Observe custom variable names and values returned in the JSON response.
**How found:** Reporter read the documented security model (only owners/maintainers can read schedule variables) and compared it against the API endpoint behavior, testing with a second account.
**Exploitation:** Any authenticated user with a token could query the pipeline schedule endpoint for a known project/schedule ID and read secret variable values, enabling schedule hijacking.
**Insight:** When a UI enforces a read restriction on secret-bearing fields, test the corresponding REST/GraphQL serializers directly—API responses often reuse models that include fields the UI hides.