A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.
The product does not properly “clean up” and remove temporary or supporting resources after they have been used.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 13.0.0 | * |
| Gitlab | Gitlab | 15.1.0 | * |
| Gitlab | Gitlab | 15.2 | 15.2 |