In GitLab Enterprise Edition (EE) 12.5.0 up to and including 12.7.5, sharing a group with a group could grant project access to unauthorized users.
gitlab gitlab