VULNERABILITY INTELLIGENCE

CVE-2022-1426

CVSS score2 LOW

EPSS probability0.91%

CISA KEVNot currently listed

Published2022-05-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Description

An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

Weakness classification

nvd@nist.gov: CWE-287

Primary references

cve@gitlab.com — Vendor Advisory
cve@gitlab.com — Broken Link
cve@gitlab.com — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory