gitlab-org--gitlab-foss/changelogs/unreleased/security-fix-pat-web-access.yml

---
title: Restrict Personal Access Tokens to API scope on web requests
merge_request:
author:
type: security
Merge branch 'security-fix-pat-web-access' into 'master' [master] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request" See merge request gitlab/gitlabhq!2583 2018-11-28 14:06:02 -05:00			`---`
			`title: Restrict Personal Access Tokens to API scope on web requests`
			`merge_request:`
			`author:`
			`type: security`