CVE-2023-3907: 
GitLab vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2023-3907) was discovered in GitLab Enterprise Edition (EE) affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2. The vulnerability allows a project Maintainer to use a Project Access Token to escalate their role to Owner (GitLab Security, NVD CVE).

The vulnerability exists in the Project Access Token rotate API functionality. When a Project Owner creates a Project Access Token with Owner role privileges, while a Maintainer cannot directly see this token, they can use the rotate API endpoint to generate a new token that inherits the Owner role permissions. This allows privilege escalation from Maintainer to Owner level access (GitLab Issue).

The vulnerability allows project Maintainers to gain unauthorized Owner-level access to projects. This elevation of privileges could potentially lead to unauthorized access to sensitive project configurations and resources that are restricted to Owner-level permissions (GitLab Security).

GitLab has addressed this vulnerability in versions 16.4.4, 16.5.4, and 16.6.2. Organizations are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the security fix (GitLab Security).