GitLab · disclosed reports
Access Control
52 disclosed reports · $100,590 paid · 48 valid · 4 informative
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open GitLab on HackerOne- reports
- 52
- valid
- 48
- paid a bounty
- 17
Every one of the 52 is a mark on the map. Named now: 27 to 52, most upvoted first.
- Unauthorized access
- Insufficient Type Check on GraphQL leading to Maintainer delete repository
- Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`
- Privilege escalation to access all private groups and repositories
- Gitlab Pages token theft using service workers
- Removing a user from a private group doesn't remove him from group's project, if his project's role was changed
- GitHub import allows user to create child group under existing namespace
- "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request
- Guest users can change the confidentiality attribute on those issues that have been assigned to them
- Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result
- User with guest access can access private merge requests
- Container escape on public GitLab CI runners
- Every user can delete public deploy keys
- Head pipeline leaked to unauthorized users via blocking merge request feature
- Blocked user Git access through CI/CD token
- State filter in IssuableFinder allows attacker to delete all issues and merge requests
- Installing Gitlab runner with Docker-In-Docker allows root access
- Revoked User can still view the Merge Request created by him via API
- Container scanning and Dependency scanning report leaked to unauthorized users
CVE-2010-4052CVE-2014-3488CVE-2016-10228CVE-2017-12794CVE-2017-16997
- Users with guest access can post notes to private merge requests, issues, and snippets
- Elasticsearch leaks data through the notes scope
- Found Origin IP's lead to access to gitlab
- Attacker can post notes on private MR, snippets, and issues
- Attacker can delete (and read) private project webhooks
- Members from parent group keep their access level on a subgroup transfer and are invisible
- Initial mirror user can be assigned by other user even if the mirror was removed
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.