Account Takeover via Password Reset without user interactions Analysed #2293343 Valid Access Control Critical 2025-02-26 $35,000 989 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control – 2019-03-05 $11,000 762 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control – 2019-11-27 $12,000 457 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control – 2019-07-03 – 351 Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com Analysed #498964 Valid Access Control – 2019-04-19 – 306 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control – 2020-08-26 – 256 Group search leaks private MRs, code, commits Analysed #692252 Valid Access Control – 2019-12-14 – 212 Group search with Elastic search enable leaks unrelated data #708820 Valid Access Control – 2019-12-14 – 100 RepositoryPipeline allows importing of local git repos #1685822 Valid Access Control – 2022-11-04 $22,300 89 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token #1193062 Valid Access Control – 2021-10-11 – 66 GraphQL query "namespace" leaks data #614355 Valid Access Control – 2019-12-03 – 64 Ability to access all user authentication tokens, leads to RCE #158330 Valid Access Control – 2016-11-03 – 61 Improper access control for users with expired password, giving the user full access through API and Git #1285226 Valid Access Control – 2022-01-27 – 49 Guest users can create new test cases #1113289 Valid Access Control – 2021-08-30 $650 49 A deactivated user can access data through GraphQL #1192460 Valid Access Control – 2021-08-30 – 47 Milestones leaked via search API #460815 Valid Access Control – 2019-07-19 – 43 Kroki Arbitrary File Read/Write #1098793 Valid Access Control – 2021-05-21 $5,600 41 Removed Guest role user who dosent have access to private project in members able to view jobs #2668302 Informative Access Control None 2024-09-18 – 38 Bypassing push rules via MRs created by Email #526570 Valid Access Control – 2019-10-01 – 36 Privilege escalation due to insecure use of logrotate #578119 Valid Access Control – 2019-10-01 – 32 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com #174983 Valid Access Control – 2016-12-06 – 31 Guest Users can create issues for Sentry errors and track their status #1117768 Valid Access Control – 2021-09-24 $610 29 Access Projects And create projects in gitlab pre production server #540711 Valid Access Control – 2019-08-28 – 28 Domain Takeover - gl-canary.freetls.fastly.net #716677 Valid Access Control – 2023-05-30 $200 25 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control – 2021-10-18 $600 21 all private tokens are leaked to an unauthenticated attacker #268794 Valid Access Control – 2017-09-21 – 20 Unauthorized access #1669176 Informative Access Control – 2022-08-25 – 18 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control – 2020-11-02 $4,000 18 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control – 2022-09-22 – 17 Privilege escalation to access all private groups and repositories #131210 Valid Access Control – 2016-07-27 – 17 Gitlab Pages token theft using service workers #1439552 Valid Access Control – 2022-06-08 $1,680 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control – 2019-04-05 – 14 GitHub import allows user to create child group under existing namespace #301137 Valid Access Control – 2018-05-24 $750 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control – 2022-06-08 – 13 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control – 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control – 2020-10-06 – 13 User with guest access can access private merge requests #195134 Valid Access Control – 2017-01-23 – 13 Container escape on public GitLab CI runners #1442118 Informative Access Control – 2022-04-27 – 12 Every user can delete public deploy keys #195088 Valid Access Control – 2017-01-23 – 12 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control – 2019-12-13 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control – 2019-12-13 $1,500 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control – 2016-12-06 – 11 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control – 2021-03-15 $1,500 9 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control – 2019-12-13 – 9 Users with guest access can post notes to private merge requests, issues, and snippets #195140 Valid Access Control – 2017-01-23 – 9 Elasticsearch leaks data through the notes scope #710006 Valid Access Control – 2020-10-06 – 8 Found Origin IP's lead to access to gitlab #1637577 Informative Access Control – 2022-08-02 – 6 Attacker can post notes on private MR, snippets, and issues #134299 Valid Access Control – 2016-05-03 – 6 Attacker can delete (and read) private project webhooks #134292 Valid Access Control – 2016-05-03 – 6