Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
Credits
Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program
