CVE-2021-22248
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only
Does this matter?
Lower severity and a low EPSS score (1.05%). Track it; it rarely justifies an emergency change on its own.
Description
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.05% probability · 64th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
EPSS 1.1% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/336074Broken Link
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/336074Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.