CVE-2021-22176: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 3.0.1, identified as CVE-2021-22176. The vulnerability relates to improper access control that allows demoted project members to access details on authored merge requests. This security flaw was initially recorded on January 5, 2021, and was publicly disclosed on March 24, 2021 (GitLab CVE, NVD).

The vulnerability is classified under CWE-863 (Incorrect Authorization) and received a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The CVSS v2.0 Base Score is 4.0 (Medium) with the vector (AV:N/AC:L/Au:S/C:P/I:N/A:N) (NVD).

The vulnerability allows Guest Role users to access Merge Request data that they are not authorized to view and edit. Even after being demoted, users can still access merge request details through the API, including viewing titles, descriptions, participants, commits, changes, pipelines, and approval statuses (GitLab Issue).

The vulnerability affects GitLab Community and Enterprise editions from version 3.0.1. Fixed versions include 13.6.7, 13.7.7, and later releases. Users are advised to upgrade to these patched versions to address the vulnerability (NVD).