CVE-2023-3979: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2023-3979) was discovered in GitLab affecting all versions from 10.6 before 16.2.8, versions from 16.3 before 16.3.5, and versions from 16.4 before 16.4.1. The vulnerability allows upstream members to collaborate with users on their branch and gain permission to write to the merge request's source branch. This vulnerability was discovered and reported by theluci through GitLab's HackerOne bug bounty program (GitLab Security Release).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 3.1 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue affects both GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability is classified under CWE-863 (Incorrect Authorization) according to GitLab's assessment (NVD).

The vulnerability allows removed developers to continue editing the source code of a public project through merge requests with collaboration options enabled. This creates a potential security risk where unauthorized users can maintain access to and modify project code even after their access has been revoked (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 16.2.8, 16.3.5, and 16.4.1. Organizations are strongly recommended to upgrade to these or later versions immediately to address this security issue. GitLab.com has already been updated with the patched version (GitLab Security Release).