CVE-2021-39896

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-398975.3Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent groCVE-2021-398985.3In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the prCVE-2021-398994.2In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change pasCVE-2021-39906.5showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CVE-2021-399002.7Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with aCVE-2021-399012.7In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoinCVE-2021-399024.3Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incidentCVE-2021-399036.5In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a CVE-2021-399044.3An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions sCVE-2021-399054.3An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groupsCVE-2021-399066.1Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vicCVE-2021-399075.3A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resu
CVE-2021-39896: Low severity, CVSS 3.8 | Vulnix