CVE-2022-3740: 
GitLab vulnerability analysis and mitigation

A security vulnerability (CVE-2022-3740) was discovered in GitLab CE/EE affecting all versions from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. The vulnerability was reported through GitLab's HackerOne bug bounty program by researcher joaxcar and was addressed in GitLab's November 2022 security release (GitLab Release).

The vulnerability is related to External Authorization service bypass. When External Authorization is enabled, a group owner could potentially bypass the authorization check to access git repositories and package registries using Deploy tokens or Deploy keys. The vulnerability has been assigned a medium severity rating with a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) (GitLab Release).

The vulnerability allows group owners to bypass External Authorization checks, potentially gaining unauthorized access to git repositories and package registries through Deploy tokens or Deploy keys. This could lead to unauthorized access to sensitive repository data and package registry contents (GitLab Release).

The vulnerability has been fixed in GitLab versions 15.3.5, 15.4.4, and 15.5.2. Organizations are strongly recommended to upgrade to these or later versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Release).