CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@gitlab.com

Published

2021-08-05

Last modified

2024-08-03

Weaknesses

CWE-863

Affected products

• Gitlab (Gitlab)
• Gitlab Ee (Gitlab)

References

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22240.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/327641
• https://hackerone.com/reports/1166566