CVE-2021-22251

MEDIUM

GitLab 12.2.0-13.12.8 - Incorrect Authorization via Email Domain Validation Bypass

Title source: llm
STIX 2.1

Description

Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings

References (3)

Core 3
Core References
Exploit, Issue Tracking, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab/-/issues/14004
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/679567

Scores

CVSS v3 4.3
EPSS 0.0022
EPSS Percentile 44.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-863
Status published
Products (1)
gitlab/gitlab 12.2.0 - 13.12.9
Published Aug 23, 2021
Tracked Since Feb 18, 2026