A vulnerability in GitLab CE/EE versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 allowed an authenticated user with developer-role permissions to commit changes to a project even after being removed as a member. This was due to improper authorization checks on merge request collaboration settings. The issue has been remediated in the specified fixed versions.