Shopping for an admin account via path traversal

This post details a path traversal vulnerability in the GitLab Customers Portal that allowed an attacker to inject attributes into API calls, enabling privilege escalation to admin on gitlab.com. The vulnerability was mitigated by enforcing numerical IDs for the `@namespace_id` parameter and implementing additional defense-in-depth measures.