Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

**Summary:** Hey team, I have discovered a way for any logged in user (attacker) to escalate his privileges to gitlab administrator if the real gitlab administrator impersonates attacker's account.

document.cookie = "_gitlab_session=█████";