An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.