CVE-2022-2459

LOW

GitLab < 15.0.5, 15.1 < 15.1.4, 15.2 < 15.2.1 - Missing Authorization for Email Invited Members

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.

References (3)

Core 3
Core References
Broken Link, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab/-/issues/336169
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1256967

Scores

CVSS v3 2.7
EPSS 0.0018
EPSS Percentile 39.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-862
Status published
Products (2)
gitlab/gitlab 15.2 (2 CPE variants)
gitlab/gitlab < 15.0.5 (2 CPE variants)
Published Aug 05, 2022
Tracked Since Feb 18, 2026