Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred
Weakness
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 12.9.0 (including) | 12.9.8 (excluding) |
| Gitlab | Gitlab | 12.10.0 (including) | 12.10.7 (excluding) |
| Gitlab | Gitlab | 13.0.0 (including) | 13.0.0 (including) |
| Gitlab | Ubuntu | esm-apps/xenial | * |
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39897.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/341017
- https://hackerone.com/reports/1330806
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39897.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/341017
- https://hackerone.com/reports/1330806