GitLab CE/EE Improper Access Control Vulnerability Allowing Privilege Escalation for Downgraded Admins

A vulnerability allowing improper access control has been identified in GitLab CE/EE. This issue affects all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1. The vulnerability allows users who were previously instance admins but have been downgraded to regular users to retain elevated privileges over groups and projects.

Impact

Exploitation of this vulnerability allows downgraded instance admins to maintain unauthorized elevated privileges, potentially leading to unauthorized access or modifications within groups and projects.