# Privilege escalation of "external user" (with maintainer privilege) to internal access through project token

External user with Maintainer role creates a project access token whose bot user has internal privileges, exposing all internal projects and source code.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: joaxcar
- Disclosed: 2021-10-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1193062
- Library page: https://bugbountylibrary.com/r/h1%3A1193062
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** GitLab project access tokens / API v4
**Root cause:** Project access token bot user is created with internal (not external) visibility, so a token minted by an external user inherits internal-instance access beyond the project scope.
**Steps:**
1. Create a user and mark it external.
2. As any internal user, invite the external user as Maintainer to a project.
3. Log in as external user and create a project access token; save it.
4. `curl --header "Authorization: Bearer <TOKEN>" https://gitlab.domain.com/api/v4/projects` to list internal projects.
5. `curl -X POST --header "Authorization: Bearer <TOKEN>" https://gitlab.domain.com/api/v4/groups?name=newg&path=newgroup` to create groups.
6. `curl -X POST --header "Authorization: Bearer <TOKEN>" https://gitlab.domain.com/api/v4/projects/21/issues?title=iWasHere` to create issues on internal projects.
7. `curl --header "Authorization: Bearer <TOKEN>" https://gitlab.domain.com/api/v4/projects/19/repository/blobs/<sha>/raw` to read internal source code.
**How found:** Reasoned that project tokens are documented as project-scoped, then tested whether the token's bot user inherits the external user's restriction or gets internal visibility; API probes confirmed broader access.
**Exploitation:** External contractor account with Maintainer on one project mints a project access token; the associated bot user has internal visibility, so the token can enumerate and read all internal projects, create issues, and create groups via the API.
**Escalation:** Any internal user can grant the external user Maintainer on a project they own, so no admin involvement is needed to reach internal-instance access.
**Insight:** When a platform has visibility tiers (external/internal), check whether machine/bot identities spawned from a restricted user inherit that restriction or default to the broader tier.