An information exposure vulnerability exists in gitlab.com <v12.3.2 <v12.2.6 and <v12.1.10 when using the blocking merge request feature it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.