Every CVESearch/Get API key

CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be...

4.2 MediumFix available

CVE-2021-22240 is a medium vulnerability (CVSS 4.2) in Gitlab, published August 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in gitlab 13.11.6.

What does this mean?
Severity
4.2 MediumCVSS 3.1, CVE List
Exploit chance
0.66%EPSS, 52nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
13.11.6gitlab

Description

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.66%Down 0.2 points since Aug 6, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gitlab
Bitnami
13.7.0 up to 13.11.6, 13.12.0 up to 13.12.6, 14.0.0 up to 14.0.2
13.11.613.12.614.0.2

What each source reports

CVE List Score used4.2

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
CVE-2021-22240
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2021-93864.2

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
EUVD-2021-9386
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-79vw-576r-jwjvNo score

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be...

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
GHSA-79vw-576r-jwjv
Weakness
CWE-863
Updated
2026-11-02
NVD4.2

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
CVE-2021-22240
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV4.3

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
CVE-2021-22240
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVBIT-gitlab-2021-22240No score

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled

Record
BIT-gitlab-2021-22240
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open