CVE-2022-1460

MEDIUM

GitLab 9.2-14.8.5, 14.9-14.9.3, 14.10 - Incorrect Authorization for Scheduled Pipelines

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/755078

Scores

CVSS v3 6.1
EPSS 0.0026
EPSS Percentile 49.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Details

CWE
CWE-863
Status published
Products (2)
gitlab/gitlab 14.10.0 (2 CPE variants)
gitlab/gitlab 9.2.0 - 14.8.6 (2 CPE variants)
Published May 11, 2022
Tracked Since Feb 18, 2026