CVE-2022-0549: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The issue stems from a missing authorization check in the REST API that allows unauthorized group membership modifications (NVD).

The vulnerability allows unprivileged users to bypass intended access controls and add other users to groups through the API endpoint, even when such actions are restricted through the web interface. This could lead to unauthorized access to group resources and potential privilege escalation (GitLab Release).

The vulnerability has been fixed in GitLab versions 14.3.6, 14.4.4, and 14.5.2 and later. Organizations are strongly recommended to upgrade to a patched version immediately. GitLab.com has already been updated with the security fix (GitLab Release).