In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.
In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.
End of life: 11/22/2021, End of support: 9/22/2021, Latest version: 14.2.7
End of life: 11/22/2021, End of support: 9/22/2021, Latest version: 14.2.7