CWE Code: 284
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Improper Access Control
Summary: an issue was discovered in gitlab community and enterprise edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. it has incorrect access control. a user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-04-16
Last Modified Date: 2019-09-09