CVE-2022-3706: 
GitLab vulnerability analysis and mitigation

Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project. The vulnerability was discovered internally by the GitLab team and was assigned CVE-2022-3706 (GitLab Security Release).

The vulnerability stems from an authorization bypass in the pipeline job retry mechanism. When a user retries a job in a downstream pipeline, they can inadvertently take ownership of all skipped jobs in any upstream pipeline, regardless of their permissions on the upstream project. This occurs through the AfterRequeueJobService, where the system processes subsequent jobs and resets the source bridge without proper permission validation. The issue has been assigned a CVSS score of 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) indicating low severity (GitLab Security Release).

The vulnerability allows unauthorized users to take control of pipeline executions in projects they don't have access to. In practical scenarios, this could lead to failed deployments when users retry QA smoke test pipelines, as they would inadvertently take ownership of SaaS deployments without proper permissions. This creates issues with accountability tracing and deployment control (GitLab Issue).

The vulnerability has been fixed in GitLab versions 15.3.5, 15.4.4, and 15.5.2. Organizations are strongly recommended to upgrade to these or newer versions immediately. GitLab.com has already been updated with the patched version (GitLab Security Release).