Gardener Authorization Bypass via Group Subject Injection

The Gardener project has disclosed a medium-severity security vulnerability, identified as GHSA-gfjv-gqf2-c888, according to the GitHub Security Advisory database. The issue lies in the `manage-members` custom verb authorization check within the Gardener API server's `customverbauthorizer` admission plugin. Specifically, this check can be bypassed by adding `Group` or `ServiceAccount` subjects to a Project's member list. While the documentation specifies that the check applies to "human users or groups," the implementation only enforces restrictions on `User`-kind subjects. This allows a project admin without `manage-members` permission to add arbitrary Group subjects, including `system:authenticated`, effectively granting all authenticated users full project-level access.

Operators should carefully review their current project membership configurations before upgrading or applying fixes. If any projects rely on the assumption that only users with `manage-members` permission can modify group memberships, this vulnerability could lead to unintended access escalation. Additionally, operators should verify whether their workflows or automation scripts depend on the current behavior of the `manage-members` check, as changes to this functionality may disrupt existing processes. This issue highlights a broader pattern in security advisories where implementation gaps between documentation and code can lead to authorization bypasses.