Launchpad.net

CVE 2021-22186

An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

See the CVE page on Mitre.org for more details.