CVE-2021-39866

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-398678.1In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to triggCVE-2021-398684.3In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited reposCVE-2021-398696.5In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.CVE-2021-39874.3An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions CVE-2021-398704.3In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by aCVE-2021-398714.3In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed CVE-2021-398726.5In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still accCVE-2021-398734.3In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visitCVE-2021-398744.3In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.CVE-2021-398755.3In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visitCVE-2021-398764.3In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.CVE-2021-398775.5A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with
CVE-2021-39866: Medium severity, CVSS 5.4 | Vulnix