CVE-2020-13263

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=9.5, <12.9.8; >=12.10, <12.10.7; >=13.0, <13.0.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/211940Broken Link
https://hackerone.com/reports/819821Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/211940Broken Link
https://hackerone.com/reports/819821Permissions Required

Timeline

Published: Jun 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-132645.3Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster CVE-2020-132655.3User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification CVE-2020-132664.3Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other user CVE-2020-132676.1A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and l CVE-2020-132685.3A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their cont CVE-2020-132696.1A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE CVE-2020-13276.1A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTM CVE-2020-132708.8Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relatio CVE-2020-132716.1A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE CVE-2020-132728.8OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow CVE-2020-132737.5A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 CVE-2020-132747.5A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitL