github_osv/GHSA-8jhx-9gf4-hhf5
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
With the consul ruby gem before 1.0.3, if a controller checks multiple powers using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.
gitlab/gem/consul/CVE-2019-16377
Incorrect Authorization
When a controller has multiple power directives, the `:only` and `:except` options of the last directive is applied to all directives. This can lead to unauthenticated access to certain controller actions.