Revoked User can still view the Merge Request created by him via API
访问控制 / 访问控制缺陷（通用） / #962604
该报告还没有中文解读。
原文摘录
摘自原文（2329 字符中的一小部分）
In Gitlab when a user is demoted to Guest role, the Guest user will not be able to view and edit the Merge requests in a project even if the merge request is created by him. But this check is not implemented in API so the Guest user will be able to the following actions for the Merge request which …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @muthu_prakash · 版权归作者与 GitLab 所有