CVE-2022-1460

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
GitLabGitLab>=9.2, <14.8.6; >=14.9, <14.9.4; >=14.10, <14.10.1

References

Timeline

Published
May 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-14616.5Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-14626.3An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinCVE-2022-14638.8The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, aCVE-2022-14645.4Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachCVE-2022-14656.1The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in aCVE-2022-14666.5Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. CVE-2022-14679.9Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bCVE-2022-14684.3On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at leasCVE-2022-14694.8The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2022-14706.1The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back CVE-2022-14719.8SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provideCVE-2022-14727.2The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using th
CVE-2022-1460: Medium severity, CVSS 4.9 | Vulnix