CVE-2021-39911

An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all…

Low · published November 4, 2021

CVSS v3.1
1.7
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers

The record
Technical detail
CVSS v3.1
1.7 · LOW
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00787 · 55.7th percentile
Published
2021-11-04T23:16Z
EPSS history
Timeline
  • 04 NOV 23:16Z
    An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all…
    cvelistv5