GitLab Enterprise Edition (EE) 10.8 and later up to and including 12.5 has Incorrect Access Control.
gitlab gitlab