A deactivated user can access data through GraphQL #1192460 Valid Access Control – 2021-08-30 – 47 XSS: `v-safe-html` is not safe enough #1579645 Valid Cross-site Scripting – 2022-11-16 – 43 Milestones leaked via search API #460815 Valid Access Control – 2019-07-19 – 43 GitLab CI runner can read and poison cache of all other projects #301432 Valid File and Path Handling – 2018-04-27 $2,000 43 Stored XSS in Mermaid when viewing Markdown files #1212822 Valid Cross-site Scripting – 2021-10-18 – 42 Kroki Arbitrary File Read/Write #1098793 Valid Access Control – 2021-05-21 $5,600 41 SQL injection in MilestoneFinder order method #298176 Valid SQL Injection – 2018-04-27 $2,000 41 When you call your branch the same name as a git hash, it could be checked out by dependents #790634 Valid Injection and Smuggling – 2021-08-19 $2,000 39 Using GitLab to monitor and hijack domains in mass quantity. #312118 Valid Input Validation and Logic – 2018-02-21 $750 39 Removed Guest role user who dosent have access to private project in members able to view jobs #2668302 Informative Access Control None 2024-09-18 – 38 Stored XSS on issue comments and other pages which contain notes #1398305 Valid Cross-site Scripting – 2022-06-08 $3,000 38 Stored XSS in blob viewer #806571 Valid Cross-site Scripting – 2020-08-04 – 37 Exposure of a valid Gitlab-Workhorse JWT leading to various bad things #1040786 Valid Authentication – 2022-07-05 $10,000 36 Injection of `http.<url>.*` git config settings leading to SSRF #855276 Valid Server-Side Request Forgery – 2020-09-08 $3,000 36 Bypassing push rules via MRs created by Email #526570 Valid Access Control – 2019-10-01 – 36 Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook #299473 Valid Server-Side Request Forgery – 2018-04-27 $750 36 IDOR in "external status check" API leaks data about any status check on the instance #1372216 Valid Insecure Direct Object Reference – 2022-02-22 – 35 Clipboard DOM-based XSS #1196958 Valid Cross-site Scripting – 2021-08-19 – 35 Store-XSS in error message of build-dependencies #950190 Valid Cross-site Scripting – 2020-12-01 – 35 Stored-XSS in merge requests #977697 Valid Cross-site Scripting – 2021-07-13 – 33 Insecure 2FA/authentication implementation creates a brute force vulnerability #149598 Valid Misconfiguration and Insecure Design – 2016-10-28 – 33 Maintainer can leak sentry token by changing the configured URL (fix bypass) #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 Stored XSS in merge request creation page through payload in approval rule name #1342009 Valid Cross-site Scripting – 2022-03-31 – 32 Privilege escalation due to insecure use of logrotate #578119 Valid Access Control – 2019-10-01 – 32 Vulnerability in project import leads to arbitrary command execution #378148 Valid Command and Code Injection – 2018-08-22 – 32 Remote hacker can download all the files of master branch in public projects where everything is members only. #1043480 Valid Authentication – 2021-02-15 – 31 Uncontrolled Resource Consumption in any Markdown field using Mermaid #670572 Valid Denial of Service – 2019-12-20 – 31 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com #174983 Valid Access Control – 2016-12-06 – 31 GitLab's GitHub integration is vulnerable to SSRF vulnerability #446593 Valid Server-Side Request Forgery – 2019-08-30 $2,000 30 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet #1751258 Valid Insecure Direct Object Reference – 2023-06-02 $1,730 29 Guest Users can create issues for Sentry errors and track their status #1117768 Valid Access Control – 2021-09-24 $610 29 Stored XSS in repository file viewer #1072868 Valid Cross-site Scripting – 2022-05-19 $2,000 29 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure – 2021-01-08 – 29 Access Projects And create projects in gitlab pre production server #540711 Valid Access Control – 2019-08-28 – 28 Drive-by arbitrary file deletion in the GDK via letter_opener_web gem #1353103 Valid Cross-Site Request Forgery – 2021-11-12 $750 27 Stored DOM XSS via Mermaid chart #1103258 Valid Cross-site Scripting – 2021-07-12 $3,000 27 Stored XSS in group issue list #859333 Valid Cross-site Scripting – 2020-11-21 $2,000 27 Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) #439729 Valid Insecure Direct Object Reference – 2019-09-19 – 27 Bypassing password authentication of users that have 2FA enabled #128085 Valid Authentication – 2016-04-18 – 27 No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im #702987 Valid Denial of Service – 2020-05-15 – 26 A profile page of a user can be denied from loading by appending .html to the username #475098 Valid Misconfiguration and Insecure Design – 2021-08-30 $200 26 Claiming package names in GitLab's automatic package referencer. #462503 Valid Input Validation and Logic – 2019-04-05 $1,000 26 DOS via issue preview #1543718 Valid Denial of Service – 2022-11-04 $7,640 25 Stored XSS on PyPi simple API endpoint #856836 Valid Cross-site Scripting – 2020-09-09 $3,000 25 Domain Takeover - gl-canary.freetls.fastly.net #716677 Valid Access Control – 2023-05-30 $200 25 Stealing data from customers.gitlab.com without user interaction #674195 Valid Insecure Direct Object Reference – 2020-08-26 – 25 SafeParamsHelper::safe_params is not so safe #946728 Valid Cross-site Scripting – 2020-11-02 $4,000 24 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure – 2020-11-21 – 24 Persistent XSS via e-mail when creating merge requests #496973 Valid Cross-site Scripting – 2019-08-30 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure – 2019-09-01 – 24