Nocasi

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 10.0 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2 **Description** An issue has been discovered in GitLab CE/EE that allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility. **Recommendations** For versions 10.0 through 15.5.7, update to version 15.5.7 or later. For versions 15.6 through 15.6.4, update to version 15.6.4 or later. For versions 15.7 through 15.7.2, update to version 15.7.2 or later. As a temporary workaround, consider restricting access to user avatars on private instances until a patch is available.