CVEvulnerability

CVE-2021-39886

4.3 MEDIUM Published 2021-10-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-10-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.6 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-276

Description

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.

Affected configurations

• gitlab gitlab (>= 10.6.0 < 14.1.7) • gitlab gitlab (>= 14.2.0 < 14.2.5) • gitlab gitlab (>= 14.3.0 < 14.3.1)

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References