Able to create merge request as reporter from forked project
Summary
User with only reporter permission is able to create a merge request if they have forked the project.
Steps to reproduce
- Create a new project
- Add a member to the project as a reporter
- As the reporter user fork the project
- Once the project is complete the 'New merge request' button is available.
- The reporter user is able to make modifications/additional branches and successfully create merge requests in the project they only have the reporter permission for.
What is the current bug behavior?
- Create merge requests is available for a reporter user that should never be able to create merge requests.
What is the expected correct behavior?
User with reporter should not be able to make merge requests
Relevant logs and/or screenshots
Reproduced on 11.11.7 and 12.2.5