A vulnerability in GitLab CE/EE versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 allowed authenticated users with reporter access to view branch names and pipeline details via the packages API endpoint, even when repository access was disabled. This issue has been remediated in the specified fixed versions.