GitLab EE Privilege Escalation Vulnerability via Custom Role Assignment

A vulnerability exists in GitLab EE versions 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1. Project Maintainers can exploit this issue by assigning custom roles to users that grant permissions exceeding their own, thereby obtaining elevated privileges.

Impact

Exploitation of this vulnerability allows Project Maintainers to gain unauthorized elevated privileges by manipulating user roles.