CVE-2021-22186: 
GitLab vulnerability analysis and mitigation

An authorization issue was discovered in GitLab CE/EE version 9.4 and up that allowed group maintainers to modify group CI/CD variables, which should have been restricted to group owners only. The vulnerability was disclosed on March 4, 2021, and was assigned the identifier CVE-2021-22186 (GitLab Release, NVD).

The vulnerability represents a privilege escalation issue where group maintainers could access and modify group-level CI/CD variables through the GitLab API, despite this functionality being intended only for group owners. The vulnerability has been assigned a CVSS v3.1 score of 4.9 (MEDIUM) and a CVSS v2.0 score of 4.0 (MEDIUM), indicating moderate severity (NVD).

The vulnerability allowed group maintainers to bypass intended access controls and manage group-level CI/CD variables, which could potentially lead to unauthorized access to sensitive configuration data and compromise the security of CI/CD pipelines (GitLab Issue).

The vulnerability was patched in GitLab security releases 13.9.2, 13.8.5, and 13.7.8. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).