CVE-2021-39886

—

CVSS 3.1

4.3 medium

EPSS

<1%p45

Published

Oct 5, 2021 (Oct 5, 2021)

Modified

Jun 17, 2026

Description

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.

Vendors: gitlab
Products: gitlab
Weakness: CWE-276
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.