Account Takeover via Password Reset without user interactions Analysed #2293343 Valid Access Control Critical 2025-02-26 $35,000 989 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control Critical 2019-03-05 $11,000 762 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control Critical 2019-11-27 $12,000 457 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control High 2019-07-03 – 351 Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com Analysed #498964 Valid Access Control Critical 2019-04-19 – 306 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control Critical 2020-08-26 – 256 Group search leaks private MRs, code, commits Analysed #692252 Valid Access Control High 2019-12-14 – 212 Group search with Elastic search enable leaks unrelated data Analysed #708820 Valid Access Control High 2019-12-14 – 100 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token Analysed #1193062 Valid Access Control Medium 2021-10-11 – 66 GraphQL query "namespace" leaks data Analysed #614355 Valid Access Control Medium 2019-12-03 – 64 Ability to access all user authentication tokens, leads to RCE Analysed #158330 Valid Access Control Critical 2016-11-03 – 61 Improper access control for users with expired password, giving the user full access through API and Git Analysed #1285226 Valid Access Control Medium 2022-01-27 – 49 Guest users can create new test cases Analysed #1113289 Valid Access Control Medium 2021-08-30 $650 49 A deactivated user can access data through GraphQL Analysed #1192460 Valid Access Control Medium 2021-08-30 – 47 Milestones leaked via search API Analysed #460815 Valid Access Control Low 2019-07-19 – 43 Kroki Arbitrary File Read/Write Analysed #1098793 Valid Access Control High 2021-05-21 $5,600 41 Bypassing push rules via MRs created by Email Analysed #526570 Valid Access Control Medium 2019-10-01 – 36 Privilege escalation due to insecure use of logrotate Analysed #578119 Valid Access Control Low 2019-10-01 – 32 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com Analysed #174983 Valid Access Control – 2016-12-06 – 31 Guest Users can create issues for Sentry errors and track their status Analysed #1117768 Valid Access Control Low 2021-09-24 $610 29 Access Projects And create projects in gitlab pre production server Analysed #540711 Valid Access Control Low 2019-08-28 – 28 Domain Takeover - gl-canary.freetls.fastly.net Analysed #716677 Valid Access Control Low 2023-05-30 $200 25 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control Medium 2021-10-18 $600 21 all private tokens are leaked to an unauthenticated attacker #268794 Valid Access Control Critical 2017-09-21 – 20 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control High 2020-11-02 $4,000 18 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control Medium 2022-09-22 – 17 Privilege escalation to access all private groups and repositories #131210 Valid Access Control – 2016-07-27 – 17 Gitlab Pages token theft using service workers #1439552 Valid Access Control Medium 2022-06-08 $1,680 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control Medium 2019-04-05 – 14 GitHub import allows user to create child group under existing namespace #301137 Valid Access Control High 2018-05-24 $750 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control Medium 2022-06-08 – 13 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control Low 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control Medium 2020-10-06 – 13 User with guest access can access private merge requests #195134 Valid Access Control Medium 2017-01-23 – 13 Every user can delete public deploy keys #195088 Valid Access Control Medium 2017-01-23 – 12 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control Low 2019-12-13 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control Medium 2019-12-13 $1,500 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control High 2016-12-06 – 11 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control Medium 2021-03-15 $1,500 9 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control Medium 2019-12-13 – 9 Users with guest access can post notes to private merge requests, issues, and snippets #195140 Valid Access Control Medium 2017-01-23 – 9 Elasticsearch leaks data through the notes scope #710006 Valid Access Control Medium 2020-10-06 – 8 Attacker can post notes on private MR, snippets, and issues #134299 Valid Access Control – 2016-05-03 – 6 Attacker can delete (and read) private project webhooks #134292 Valid Access Control – 2016-05-03 – 6 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control High 2020-09-08 – 5 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control Medium 2020-08-26 $3,000 4