CVE-2021-39909

—

CVSS 3.1

5.3 medium

EPSS

<1%p47

Published

Nov 5, 2021 (Nov 5, 2021)

Modified

Jun 17, 2026

Description

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

Vendors: gitlab
Products: gitlab
Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.