CVE-2021-22236

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222374.9Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. CVE-2021-222385.4An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design CVE-2021-222394.3An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.CVE-2021-22248.1Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Compensation Workbench). Supported version CVE-2021-222404.3Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap be CVE-2021-222415.4An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scrip CVE-2021-222425.4Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site sc CVE-2021-222434.3Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another ema CVE-2021-222446.5Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulne CVE-2021-222452.7Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossibl CVE-2021-222466.5A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial CVE-2021-222474.3Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics