An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user if the file size and OID are known.