VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Oct 4, 2021· Updated Jun 17, 2026

CVE-2021-39883

CVE-2021-39883

Description

Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups.

Affected products

6
  • GitLab Inc./GitLab4 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*+ 3 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.11.0,<14.1.7
    • cpe:2.3:a:gitlab:gitlab:14.3.0:*:*:*:enterprise:*:*:*
    • (no CPE)range: starting from 13.11 before 14.1.7, starting from 14.2 before 14.2.5, and starting from 14.3 before 14.3.1
    • (no CPE)range: >=13.11, <14.1.7
  • GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
    Range: starting from 13.11 before 14.1.7, starting from 14.2 before 14.2.5, and starting from 14.3 before 14.3.1
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 13.11.0, < 14.1.7

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.