CVE-2021-4191

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=14.8, <14.8.2; >=14.7, <14.7.4; >=13.0, <14.6.5

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898Broken Link
https://hackerone.com/reports/1089609Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898Broken Link
https://hackerone.com/reports/1089609Permissions Required, Third Party Advisory

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-419168.8A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrati CVE-2021-419175.4webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in CVE-2021-419185.4webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-CVE-2021-419198.8webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This CVE-2021-41927.8vim is vulnerable to Use After Free CVE-2021-419207.5webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl CVE-2021-419219.8novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code ex CVE-2021-419246.1Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).CVE-2021-419289.8SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code vi CVE-2021-419296.1Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary CVE-2021-41935.5vim is vulnerable to Out-of-bounds Read CVE-2021-419306.1Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to ex