GitLab RBAC Bypass: User-level ACLs ignore org membership checks leading to unauthorized access

Vulnerability Summary: User-level ACL grants on org-scoped resources bypass organization membership checks Vulnerability Overview GitLab's RBAC engine does not verify organization membership when evaluating user-level ACL entries. This allows an attacker to grant user-level ACL entries to organization-scoped resources (such as templates), thereby bypassing access control after a user is removed from the organization. Impact Scope Affected Components: and sections Affected Versions: - Fixed versions: - Patched versions: Severity: Medium (CVSS 10) Impact: - Allows granting user-level ACL entries to organization-scoped resources (such as templates) - Subsequent removal of the user from the organization leaves the ACL entry valid, resulting in unauthorized access Remediation 1. Add organization membership check: Add verification of organization membership in user-level ACL entries (matching existing group-level ACL rules). 2. Automatically remove ACL entries: Automatically delete the user-level ACL entries when a user is removed from the organization. 3. Manual cleanup: Administrators can manually inspect and remove user-level ACL entries on organization-scoped resources. Exploitation Conditions The target user must have been explicitly granted a user-level ACL entry for an organization-scoped resource. The user must have been removed from the organization, but the ACL entry has not been manually deleted. All GitLab deployments are affected. Fixed Versions 2.36 branch: 2.35 branch: 2.34 branch: Acknowledgments Thanks to the Anthosy security team (JNT-2020-22480) for independently disclosing this vulnerability. --- Note: No POC code or exploitation code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

GitLab RBAC Bypass: User-level ACLs ignore org membership checks leading to unauthorized access

More from this source