CVE-2023-3915
Description
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects.
Summary dbcve.org
In GitLab EE, an external user granted owner role on any group can create a service account within that group. The created service account is incorrectly classified as internal rather than external, allowing it to bypass external user restrictions and access internal projects that should be inaccessible to external users.
Mitigation
Upgrade GitLab EE to version 16.1.5, 16.2.5, 16.3.1 or later. Until upgraded, audit groups where external users hold owner role and monitor for unauthorized service account creation.