CVE-2021-39866: 
GitLab vulnerability analysis and mitigation

A business logic error was discovered in GitLab versions 13.6 and later that allows persistent access via project access tokens even after project deletion. The vulnerability was assigned identifier CVE-2021-39866 and was disclosed on September 30, 2021. This vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE) installations (GitLab Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 5.4 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue stems from a business logic error in the project deletion process where project access tokens remain valid and usable even after the associated project has been deleted (NVD).

When exploited, this vulnerability allows continued access to GitLab resources through project access tokens that should have been invalidated during the project deletion process. This creates a potential security risk where unauthorized users may retain access to system resources that should have been revoked (GitLab Release).

GitLab has addressed this vulnerability in versions 14.3.1, 14.2.5, and 14.1.7. Users are strongly recommended to upgrade to one of these patched versions immediately to mitigate the risk (GitLab Release).