CVEvulnerability

CVE-2021-39909

5.3 MEDIUM Published 2021-11-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-347

Description

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

Affected configurations

• gitlab gitlab (>= 11.3.0 < 14.2.6) • gitlab gitlab (>= 14.3.0 < 14.3.4) • gitlab gitlab 14.4.0 • gitlab gitlab (>= 11.2.0 < 14.3.4) • gitlab gitlab (>= 11.3.0 < 14.4.1)

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References