# Members from parent group keep their access level on a subgroup transfer and are invisible

Transferring a subgroup to another group leaves parent-group members as invisible ghost members retaining full access to the transferred subgroup and its projects.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: kryword
- Disclosed: 2020-09-08
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/790786
- Library page: https://bugbountylibrary.com/r/h1%3A790786
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control

**Target:** GitLab group/subgroup transfer feature
**Root cause:** Subgroup transfer does not revoke inherited membership from the original parent group, leaving stale access grants that are not surfaced in the members list.
**Steps:**
1. Create two private groups GroupA and GroupB; add a maintainer/owner user to GroupA only.
2. Create subgroupA in GroupA and project-test inside it.
3. Transfer subgroupA to GroupB.
4. As the GroupA-only user, access the transferred subgroup and project — access is retained.
5. Check members tab: the user does not appear, yet can view settings and modify/delete the project.
**How found:** Tester reasoned that inherited parent-group membership should be severed on transfer, then verified by transferring a subgroup between two private groups and checking access with a non-member of the destination.
**Exploitation:** A user who was a member of the original parent group retains maintainer/owner privileges on the transferred subgroup and its projects, and gains implicit access to the new private parent group, without appearing in the members list.
**Escalation:** Owner-level ghost membership allows adding/removing members or deleting projects in the new namespace.
**Insight:** When testing group/namespace transfer features, always re-check inherited membership from the source parent after transfer — stale ACL rows often survive and are hidden from the members UI, so verify via direct URL access rather than the members tab.