CVE-2020-10088

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.htmlRelease Notes, Vendor Advisory
https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.htmlRelease Notes, Vendor Advisory

Timeline

Published: Mar 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-100897.5GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,CVE-2020-10097.8An elevation of privilege vulnerability exists in the way that the Microsoft Store Install Service handles file operations in protected loca CVE-2020-100905.3GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being d CVE-2020-100916.1GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.CVE-2020-100926.1GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integra CVE-2020-100935.4A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.CVE-2020-100945.4A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX CVE-2020-100958.1Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device.CVE-2020-100967.5An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who e CVE-2020-100975.3An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastr CVE-2020-100985.4An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionali CVE-2020-100995.4An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functional