CVE-2022-1426

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.6, <14.8.6; >=14.9, <14.9.4; >=14.10, <14.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296866Broken Link
https://hackerone.com/reports/1070097Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296866Broken Link
https://hackerone.com/reports/1070097Permissions Required, Third Party Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14277.8Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if be CVE-2022-14284.3An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta CVE-2022-14297.5SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data CVE-2022-14307.5Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.CVE-2022-14315.3An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14326.4Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.CVE-2022-14336.1An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.CVE-2022-14345.9The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially pre CVE-2022-14354.8The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege CVE-2022-14366.1The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting CVE-2022-14377.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the CVE-2022-14384.8A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-