SVN access files with binded user groups are not properly updated.

Impact

A user could still have the specific rights of a group when it have been removed or at the contrary does not have these specific rights.
CVSS2 score: 3.6 (AV:N/AC:H/Au:S/C:P/I:P/A:N)
CVSS3 score: 4.2 (3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)

Reproduction

Create two projects: project1 and project2.

In project1 add two users in a user group. In project2 create a binded user group to the user group you have created in project1.

References

https://cwe.mitre.org/data/definitions/269.html