CVE-2020-13282: 
GitLab vulnerability analysis and mitigation

For GitLab versions before 13.0.12, 13.1.6, and 13.2.3, a security vulnerability was discovered where after a group transfer occurs, members from a parent group maintain their access level on the subgroup, leading to improper access control. The vulnerability was discovered on February 7, 2020, and was officially patched on August 5, 2020 (GitLab Release, CVE Mitre).

The vulnerability occurs during the group transfer functionality in GitLab. When a subgroup is transferred from one namespace to another, users who were members of the original parent group retain their permissions and access levels on the transferred subgroup, even though they are not explicitly listed as members. These 'ghost' members maintain their original privileges, including administrative access if they previously held such permissions, without appearing in the members tab of the transferred subgroup (GitLab Issue).

The impact of this vulnerability is significant as it allows unauthorized users to maintain access to transferred subgroups and their projects. Users who were part of the original parent group retain their previous access levels, including administrative privileges if they held them, even after the transfer. These users can continue to modify, access, and even delete projects within the transferred subgroup without being visible in the members list (GitLab Issue).

The vulnerability can be exploited by creating two different private groups, adding members to the first group, creating a subgroup with projects in the first group, and then transferring the subgroup to the second group. The members from the first group would retain their access levels and permissions to the transferred subgroup and its projects, despite not being listed as members (GitLab Issue).

The vulnerability has been fixed in GitLab versions 13.0.12, 13.1.6, and 13.2.3. GitLab strongly recommends that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Release).

The vulnerability was responsibly reported by security researcher @kryword through the HackerOne platform. GitLab acknowledged the issue and addressed it in their security release, demonstrating their commitment to maintaining strong security standards (GitLab Release).