Add Changelog entry for group link permissions fix

CHANGELOG

@@ -90,6 +90,9 @@ v 8.7.0 (unreleased)
   - Fix emoji catgories in the emoji picker
   - Execute system web hooks on push to the project
 
+v 8.6.7 (unreleased)
+  - Fix vulnerability that made it possible to enumerate private projects belonging to group
+
 v 8.6.6
   - Expire the exists cache before deletion to ensure project dir actually exists (Stan Hu). !3413
   - Fix error on language detection when repository has no HEAD (e.g., master branch) (Jeroen Bobbeldijk). !3654