VYPR
← All advisories
Medium severity4.9NVD Advisory· Published Mar 24, 2021· Updated Jun 17, 2026

CVE-2021-22186

CVE-2021-22186

Description

An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

Affected products

6
  • GitLab Inc./GitLab4 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 3 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=9.4.0,<13.7.8
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=9.4.0,<13.7.8
    • (no CPE)range: >=9.4
    • (no CPE)range: >=9.4, <13.7.8
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: >=9.4
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 9.4.0, < 13.7.8

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.