GitLab before 5.4.2 Community Edition before 6.2.4 and Enterprise Edition before 6.2.1 when using a MySQL backend allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.