An issue exists in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 up to and including 12.6.1. It has Incorrect Access Control.
gitlab gitlab