← All advisories

Low severity2.7NVD Advisory· Published Nov 5, 2021· Updated Jun 17, 2026

CVE-2021-39901

CVE-2021-39901

Description

In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

Affected products

7

GitLab Inc./GitLab5 versions
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 4 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=11.10.0,<14.2.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=11.10.0,<14.2.6
- cpe:2.3:a:gitlab:gitlab:14.4.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:14.4.0:*:*:*:enterprise:*:*:*
- (no CPE)range: >=11.10, <14.2.6
GitLab Inc./GitLab EE and CEllm-fuzzy
Range: >=11.10
osv-coords
pkg:bitnami/gitlab
Range: >= 11.10.0, < 14.2.6

Patches

Vulnerability mechanics

References

3

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39901.jsonnvdVendor Advisory
hackerone.com/reports/565884nvdPermissions RequiredThird Party Advisory
gitlab.com/gitlab-org/gitlab/-/issues/11640nvdBroken Link

News mentions

0

No linked articles in our index yet.