Gitlab · Gitlab Ce/Ee · CVE-2022-2307
**Name of the Vulnerable Software and Affected Versions**
GitLab CE/EE versions 13.0 through 15.0.5
GitLab CE/EE versions 15.1 through 15.1.4
GitLab CE/EE versions 15.2 through 15.2.1
**Description**
The issue is related to a lack of cascading deletes, allowing a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted. Although the APIs usable by that token are limited, this still poses a risk.
**Recommendations**
For GitLab CE/EE versions 13.0 through 15.0.5, update to version 15.0.5 or later.
For GitLab CE/EE versions 15.1 through 15.1.4, update to version 15.1.4 or later.
For GitLab CE/EE versions 15.2 through 15.2.1, update to version 15.2.1 or later.