An issue exists in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 up to and including 12.6.1. It has Incorrect Access Control.
gitlab gitlab