CVE-2021-22251

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.2, <13.12.9; >=14.0, <14.0.7; >=14.1, <14.1.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22251.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/14004Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/679567Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22251.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/14004Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/679567Permissions Required, Third Party Advisory

Timeline

Published: Aug 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222526.5A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variab CVE-2021-222535.4Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger depl CVE-2021-222544.3Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later throu CVE-2021-222556.5SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over CVE-2021-222565.4Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track th CVE-2021-222575.3An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222584.3The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses CVE-2021-222596.5A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.CVE-2021-22264.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2021-222605.4A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all CVE-2021-222614.8A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st CVE-2021-222624.3Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers