Medium severity4.3NVD Advisory· Published Oct 5, 2021· Updated Jun 17, 2026
CVE-2021-39888
CVE-2021-39888
Description
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates.
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.10.0,<14.1.7
- cpe:2.3:a:gitlab:gitlab:14.3.0:*:*:*:enterprise:*:*:*
- (no CPE)range: 13.10 <= v < 14.1.7, 14.2 <= v < 14.2.5, 14.3 <= v < 14.3.1
- (no CPE)range: >=13.10, <14.1.7
- Range: 13.10 <= v < 14.1.7, 14.2 <= v < 14.2.5, 14.3 <= v < 14.3.1
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/gitlab/-/issues/336446nvdBroken LinkExploitIssue TrackingVendor Advisory
- gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39888.jsonnvdVendor Advisory
- hackerone.com/reports/1255128nvdPermissions Required
News mentions
0No linked articles in our index yet.