CVE-2021-39870

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=11.11, <14.1.7; >=14.2, <14.2.5; >=14.3, <14.3.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39870.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/29748Broken Link
https://hackerone.com/reports/630263Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39870.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/29748Broken Link
https://hackerone.com/reports/630263Permissions Required, Third Party Advisory

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-398714.3In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed CVE-2021-398726.5In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still acc CVE-2021-398734.3In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visit CVE-2021-398744.3In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.CVE-2021-398755.3In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visit CVE-2021-398764.3In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.CVE-2021-398775.5A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with CVE-2021-398785.4A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to exe CVE-2021-398793.5Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable CVE-2021-39886.1A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occur CVE-2021-398806.5A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all ve CVE-2021-398813.5In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrar