CVE-2021-39884

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=8.13, <14.1.7; >=14.2, <14.2.5; >=14.3, <14.3.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39884.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/25414Broken Link
https://hackerone.com/reports/447817Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39884.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/25414Broken Link
https://hackerone.com/reports/447817Permissions Required

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-398855.4A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 b CVE-2021-398864.3Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up t CVE-2021-398875.4A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to exe CVE-2021-398884.3In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting fro CVE-2021-398894.3In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protec CVE-2021-39896.1showdoc is vulnerable to URL Redirection to Untrusted Site CVE-2021-398909.8It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.CVE-2021-398914.9In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the e CVE-2021-398924.3In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer CVE-2021-398937.5A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.CVE-2021-398945.4In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers t CVE-2021-398954.5In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an un