CVE-2021-39937: 
GitLab vulnerability analysis and mitigation

A collision in access memoization logic was discovered in GitLab CE/EE affecting all versions before 14.3.6, versions from 14.4 before 14.4.4, and versions from 14.5 before 14.5.2. The vulnerability could lead to potential elevated privileges in groups and projects under rare circumstances (GitLab Security Release, NVD).

The vulnerability stems from a collision in access memoization logic where the BulkMemberAccessLoad concern did not properly differentiate memoization indexes across models. The issue received a CVSS v3.1 base score of 8.8 (HIGH) from NVD and 5.9 (MEDIUM) from GitLab Inc. The vulnerability is tracked as CWE-269 (Improper Privilege Management) (NVD).

The vulnerability could allow attackers to gain elevated privileges in groups and projects under specific circumstances. The memoization issue meant that if access was checked for a group with a certain ID, the same access level could be incorrectly applied to a project with the same ID in the same request, potentially granting unauthorized access (GitLab Security Release).

The vulnerability was discovered internally by the GitLab team. While the vulnerability required specific conditions to be exploited, it could be triggered through normal application usage when accessing groups and projects with matching IDs (GitLab Security Release).

The vulnerability was fixed in GitLab versions 14.3.6, 14.4.4, and 14.5.2. Users are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Security Release).