Impersonating an admin who impersonates yourself leads to a non-audited authenticated session
Procedure:
- Have two or more admin users (Alice and Bob)
- Log in as Alice (yourself)
- Impersonate Bob
- In that impersonation sessions, impersonate Alice
- Stop impersonation
- See that you are now logged in as Bob
- However, you really are still Alice, but GitLab's interface no longer indicates that you are impersonating Bob, rather you are Bob.