CVE-2020-10088: 
GitLab vulnerability analysis and mitigation

GitLab versions 12.5 through 12.8.1 contained a vulnerability related to incorrect permission levels for group invites. Under specific group settings configurations, the system could assign incorrect permission levels to invited groups (GitLab Release).

The vulnerability, tracked as CVE-2020-10088, was discovered in GitLab's group invitation system. The issue manifested when certain group settings were configured, resulting in the system assigning incorrect permission levels to invited groups. This security flaw affected the access control mechanism of GitLab's group management functionality (GitLab Release).

The vulnerability could lead to privilege escalation within GitLab groups, as invited groups might receive higher or different permission levels than intended. This could potentially result in unauthorized access to group resources and data (GitLab Release).

The vulnerability affected GitLab installations running versions 12.5 and later, until it was patched in version 12.8.2. The issue required specific group settings to be exploitable (GitLab Release).

GitLab addressed this vulnerability in versions 12.8.2, 12.7.7, and 12.6.8. The vendor strongly recommended that all installations running affected versions be upgraded to the latest version as soon as possible to mitigate the risk (GitLab Release).

The vulnerability was responsibly reported by Cristian Berner, and GitLab acknowledged this contribution in their security release announcement (GitLab Release).