GitLab Enterprise Edition (EE) 8.90 and later up to and including 12.5 has Incorrect Access Control.
gitlab gitlab