CVE-2021-22176

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.8.0, <13.8.4; >=13.7.0, <13.7.7; >=3.0.1, <13.6.7

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/243491Vendor Advisory
https://hackerone.com/reports/962604Issue Tracking, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/243491Vendor Advisory
https://hackerone.com/reports/962604Issue Tracking, Third Party Advisory

Timeline

Published: Mar 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-221774.3Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource CVE-2021-221785.0An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheu CVE-2021-221795.4A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.CVE-2021-22188.3Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Health Center). Supported versions that a CVE-2021-221804.3An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to acces CVE-2021-221816.5A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relati CVE-2021-221825.4An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.CVE-2021-221835.4An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, w CVE-2021-221845.5An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive informat CVE-2021-221855.4Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerabi CVE-2021-221864.9An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restric CVE-2021-221874.3An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allo