Users can create groups without being allowed to via GitHub import

• Title: Users can create groups without being allowed to
• Types: Privilege Escalation
• Link: https://hackerone.com/reports/163349
• Date: 2016-08-25 09:32:22 -0500
• By: skylarkelty

Details:

If I import from Github, it takes the username as a group name. This means if I create any user in Github with the group name I want, I can then import a blank project from this user and the group is created for me! Our admins don't like this.

cc @dbalexandre