CVE-2021-22263

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.0, <14.0.9; >=14.1, <14.1.4; >=14.2, <14.2.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/331473Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1193062Exploit, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/331473Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1193062Exploit, Third Party Advisory

Timeline

Published: Oct 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222646.5An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.CVE-2021-222675.9Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0 CVE-2021-22278.1Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Bank Account Transfer). Supported versions that a CVE-2021-222729.4The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to CVE-2021-222758.6Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic progra CVE-2021-222765.5The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.CVE-2021-222777.5Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control an CVE-2021-222786.7A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on compute CVE-2021-222799.8A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the rob CVE-2021-22288.1Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: User Interface). Supported versions that a CVE-2021-222807.2Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code CVE-2021-222817.5: Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Aut