CVE-2021-39896

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=8.0, <14.1.7; >=14.2, <14.2.5; >=14.3, <14.3.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39896.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/339362Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39896.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/339362Broken Link

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-398975.3Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent gro CVE-2021-398985.3In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the pr CVE-2021-398994.2In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change pas CVE-2021-39906.5showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CVE-2021-399002.7Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a CVE-2021-399012.7In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoin CVE-2021-399024.3Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident CVE-2021-399036.5In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a CVE-2021-399044.3An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions s CVE-2021-399054.3An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups CVE-2021-399066.1Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vic CVE-2021-399075.3A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resu