{"api_version":"1","generated_at":"2026-07-23T14:28:44+00:00","cve":"CVE-2021-39883","urls":{"html":"https://cve.report/CVE-2021-39883","api":"https://cve.report/api/cve/CVE-2021-39883.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-39883","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39883"},"summary":{"title":"CVE-2021-39883","description":"Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups.","state":"PUBLIC","assigner":"cve@gitlab.com","published_at":"2021-10-04 17:15:00","updated_at":"2022-10-06 20:00:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/334279","name":"https://gitlab.com/gitlab-org/gitlab/-/issues/334279","refsource":"MISC","tags":[],"title":"Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39883.json","name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39883.json","refsource":"CONFIRM","tags":[],"title":"2021/CVE-2021-39883.json · master · GitLab.org / cves · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39883","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39883","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"This vulnerability has been discovered internally by the GitLab team","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"39883","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39883","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"14.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-39883","qid":"376097","title":"GitLab Multiple Security Vulnerabilities (gitlab- 14.3.1, 14.2.5, 14.1.7)"},{"cve":"CVE-2021-39883","qid":"690021","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (1bdd4db6-2223-11ec-91be-001b217b3468)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-39883","ASSIGNER":"cve@gitlab.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"GitLab","product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=13.11, <14.1.7"},{"version_value":">=14.2, <14.2.5"},{"version_value":">=14.3, <14.3.1"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper authorization in GitLab"}]}]},"references":{"reference_data":[{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/334279","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/334279","refsource":"MISC"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39883.json","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39883.json","refsource":"CONFIRM"}]},"description":{"description_data":[{"lang":"eng","value":"Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups."}]},"impact":{"cvss":{"vectorString":"AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","version":"3.1","baseScore":4.2,"baseSeverity":"MEDIUM"}},"credit":[{"lang":"eng","value":"This vulnerability has been discovered internally by the GitLab team"}]},"nvd":{"publishedDate":"2021-10-04 17:15:00","lastModifiedDate":"2022-10-06 20:00:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.2.0","versionEndExcluding":"14.2.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:14.3.0:*:*:*:enterprise:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"13.11.0","versionEndExcluding":"14.1.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"39883","Ordinal":"215589","Title":"CVE-2021-39883","CVE":"CVE-2021-39883","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"39883","Ordinal":"1","NoteData":"Improper authorization checks in GitLab EE > 13.11 allows subgroup members to see epics from all parent subgroups.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"39883","Ordinal":"2","NoteData":"2021-10-04","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"39883","Ordinal":"3","NoteData":"2021-10-04","Type":"Other","Title":"Modified"}]}}}