Access Control

Every one of the 371 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Missing Authorization in GitLabCVE-2025-5121GitLab · CVSS 8.5 · 12% likely

   CWE-862

2. The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated u…CVE-2016-4340Gitlab · 10% likely

   CWE-264

3. Incorrect Authorization in GitLabCVE-2023-5009GitLab · CVSS 8.2 · 9.7% likely

   CWE-863

4. Improper Access Control in GitLabCVE-2024-5655GitLab · CVSS 9.6 · 7.5% likely

   CWE-284

5. Improper Access Control in GitLabCVE-2024-6385GitLab · CVSS 9.6 · 7.2% likely

   CWE-284

6. An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 1…CVE-2023-2478GitLab · CVSS 9.6 · 5.0% likely

   CWE-732

7. Missing Authorization in GitLabCVE-2023-5612GitLab · CVSS 5.3 · 4.9% likely

   CWE-862

8. Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For Git…CVE-2016-9469Gitlab · 2.4% likely

   CWE-7491 bounty report

9. The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.CVE-2014-8540Gitlab · 2.2% likely

   CWE-264

10. Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an u…CVE-2018-19577Gitlab · 2.1% likely

    CWE-284

11. The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows…CVE-2013-4583GitLab · 2.0% likely

    CWE-269

12. GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI…CVE-2018-19569Gitlab · 1.8% likely

    CWE-285

13. An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5CVE-2020-13277GitLab · CVSS 6.3 · 1.8% likely

    CWE-863

14. An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran…CVE-2019-15729Gitlab · 1.7% likely

    CWE-863

15. An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.CVE-2018-20494Gitlab · 1.6% likely

    CWE-863

16. An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy TokensCVE-2020-13296GitLab · CVSS 6.5 · 1.6% likely

    CWE-862

17. A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by be…CVE-2020-13308GitLab · CVSS 2.7 · 1.6% likely

    CWE-281

18. In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mu…CVE-2020-13334GitLab · CVSS 5.9 · 1.5% likely

    CWE-863

19. An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).CVE-2019-9224Gitlab · 1.5% likely

    CWE-862

20. An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project TemplateCVE-2020-13343GitLab · CVSS 7.5 · 1.5% likely

    CWE-668

21. Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all vers…CVE-2022-1423GitLab · CVSS 7.1 · 1.5% likely

    CWE-862

22. Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attac…CVE-2022-1148GitLab · CVSS 5.3 · 1.5% likely

    CWE-565

23. An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runne…CVE-2018-20500Gitlab · 1.4% likely

    CWE-732

24. Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.CVE-2017-0926GitLab · 1.4% likely

    CWE-285

25. An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge…CVE-2019-5487Gitlab · 1.4% likely

    CWE-2841 bounty report

26. GitLab EE 8.9 and later through 12.7.2 has Insecure PermissionCVE-2020-8114Gitlab · 1.4% likely

    CWE-276

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.