CVE-2021-39909

MEDIUM

GitLab 11.3.0-14.2.5, 14.3.0-14.3.3, 14.4.0 - CODEOWNERS Approval Bypass via Email Address Verification Lack

Title source: llm
STIX 2.1

Description

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1237750

Scores

CVSS v3 5.3
EPSS 0.0005
EPSS Percentile 15.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-347
Status published
Products (2)
gitlab/gitlab 14.4.0
gitlab/gitlab 11.3.0 - 14.2.6
Published Nov 05, 2021
Tracked Since Feb 18, 2026