CVE-2022-2512: 
GitLab vulnerability analysis and mitigation

CVE-2022-2512 is a security vulnerability discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, and all versions starting from 15.2 before 15.2.1. The vulnerability was discovered internally by the GitLab team and disclosed on July 28, 2022 (GitLab Release).

The vulnerability involves membership changes not being properly reflected in TODO notifications for confidential notes, which could allow former project members to continue reading updates via TODOs even after their access has been revoked. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (GitLab Release).

The vulnerability allows former project members to maintain unauthorized access to confidential information through TODO notifications, even after their project access has been revoked. This creates a potential information disclosure risk where sensitive data could be exposed to unauthorized individuals (GitLab Release).

The vulnerability has been fixed in GitLab versions 15.0.5, 15.1.4, and 15.2.1. Organizations are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com has already been updated to run the patched version (GitLab Release).