CVE-2021-22249

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.2, <13.12.9; >=14.0, <14.0.7; >=14.1, <14.1.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22249.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/331857Broken Link
https://hackerone.com/reports/1204320Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22249.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/331857Broken Link
https://hackerone.com/reports/1204320Permissions Required, Third Party Advisory

Timeline

Published: Aug 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-22258.1Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are CVE-2021-222505.4Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administ CVE-2021-222514.3Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emai CVE-2021-222526.5A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variab CVE-2021-222535.4Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger depl CVE-2021-222544.3Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later throu CVE-2021-222556.5SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over CVE-2021-222565.4Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track th CVE-2021-222575.3An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222584.3The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses CVE-2021-222596.5A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.CVE-2021-22264.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are