CVE-2023-0805: 
GitLab vulnerability analysis and mitigation

A vulnerability has been discovered in GitLab Enterprise Edition (EE) affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, and all versions starting from 15.11 before 15.11.1. The vulnerability is tracked as CVE-2023-0805 and was reported through GitLab's HackerOne bug bounty program (GitLab Security Release).

The vulnerability allows a banned group member to retain access to public projects within a public group with the same access level they had before being banned. This issue has been assessed as a medium severity vulnerability with a CVSS score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) (GitLab Security Release).

When exploited, this vulnerability allows malicious group members to maintain access to public projects within a public group even after being banned by the group owner. While access to private projects is properly revoked upon banning, the user retains their previous access level to public projects, potentially allowing them to continue performing actions based on their previous role (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.9.6, 15.10.5, and 15.11.1. Organizations are strongly recommended to upgrade to one of these patched versions immediately to mitigate the vulnerability (GitLab Security Release).