CVE-2021-39872

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-398734.3In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visit CVE-2021-398744.3In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.CVE-2021-398755.3In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visit CVE-2021-398764.3In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.CVE-2021-398775.5A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with CVE-2021-398785.4A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to exe CVE-2021-398793.5Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable CVE-2021-39886.1A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occur CVE-2021-398806.5A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all ve CVE-2021-398813.5In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrar CVE-2021-398825.3In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.CVE-2021-398834.3Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5,