CVE-2021-39945: 
GitLab vulnerability analysis and mitigation

Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked (CVE Mitre, GitLab Release).

The vulnerability stems from an improper access control mechanism in GitLab's API that fails to properly validate user permissions when handling Merge Request approvals. The issue has a CVSS v3.1 Base Score of 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, and a CVSS v2.0 Base Score of 4.0 (MEDIUM) (NVD).

When exploited, this vulnerability allows demoted users to continue approving merge requests they authored, even after their project access has been revoked. Additionally, the vulnerability leads to unauthorized access to merge request details that should be restricted from the demoted user (GitLab Issue).

The vulnerability has been fixed in GitLab versions 14.3.6, 14.4.4, and 14.5.2. Users are strongly recommended to upgrade to these or later versions to mitigate the security risk (GitLab Release).