CVE-2022-4167: 
GitLab vulnerability analysis and mitigation

Incorrect Authorization check affecting GitLab Enterprise Edition (EE) versions from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them (NVD, GitLab Security Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 score of 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). The issue specifically affects the authorization mechanism for group access tokens in GitLab EE, where tokens remain functional even after the group owner's revocation capabilities are removed (GitLab Security Release).

When exploited, this vulnerability allows group access tokens to remain active and usable even after a group's subscription expires or when the group owner loses administrative privileges. This creates a security risk where previously issued tokens cannot be revoked, potentially leading to unauthorized access to group resources (GitLab Issue).

The vulnerability has been patched in GitLab Enterprise Edition versions 15.5.7, 15.6.4, and 15.7.2. Organizations are strongly recommended to upgrade to one of these patched versions immediately to address this security issue (GitLab Security Release).