Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic Medium 2019-08-30 – 249 DoS on the Issue page by exploiting Mermaid. Analysed #470067 Valid Denial of Service Medium 2019-05-13 $3,000 145 Send arbitrary PUT requests when user clicks on a link Analysed #824689 Valid Command and Code Injection Medium 2020-07-27 – 135 IDOR Exposes All Machine Learning Models Analysed #2528293 Valid Insecure Direct Object Reference Medium 2024-10-01 $1,160 117 Account takeover due to insufficient URL validation on RelayState parameter Analysed #1923672 Valid Cross-Site Request Forgery Medium 2023-05-30 $2,450 99 XSS in request approvals Analysed #402658 Valid Cross-site Scripting Medium 2021-04-23 $3,000 96 Unrestricted file upload leads to Stored XSS Analysed #880099 Valid Cross-site Scripting Medium 2020-08-03 – 90 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 SSRF in CI after first run Analysed #369451 Valid Server-Side Request Forgery Medium 2019-04-12 – 72 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token Analysed #1193062 Valid Access Control Medium 2021-10-11 – 66 DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server Analysed #2499070 Valid Denial of Service Medium 2024-10-09 $2,300 64 GraphQL query "namespace" leaks data Analysed #614355 Valid Access Control Medium 2019-12-03 – 64 Stored-XSS on wiki pages Analysed #1087061 Valid Cross-site Scripting Medium 2021-07-13 – 59 Change project visibility to a restricted option Analysed #1086781 Valid Misconfiguration and Insecure Design Medium 2021-12-30 $1,370 51 Improper access control for users with expired password, giving the user full access through API and Git Analysed #1285226 Valid Access Control Medium 2022-01-27 – 49 Guest users can create new test cases Analysed #1113289 Valid Access Control Medium 2021-08-30 $650 49 XSS on Issue reference numbers Analysed #831962 Valid Cross-site Scripting Medium 2020-11-23 – 49 A deactivated user can access data through GraphQL Analysed #1192460 Valid Access Control Medium 2021-08-30 – 47 When you call your branch the same name as a git hash, it could be checked out by dependents #790634 Valid Injection and Smuggling Medium 2021-08-19 $2,000 39 Stored XSS in blob viewer #806571 Valid Cross-site Scripting Medium 2020-08-04 – 37 Bypassing push rules via MRs created by Email #526570 Valid Access Control Medium 2019-10-01 – 36 IDOR in "external status check" API leaks data about any status check on the instance #1372216 Valid Insecure Direct Object Reference Medium 2022-02-22 – 35 Clipboard DOM-based XSS #1196958 Valid Cross-site Scripting Medium 2021-08-19 – 35 Maintainer can leak sentry token by changing the configured URL (fix bypass) #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 Remote hacker can download all the files of master branch in public projects where everything is members only. #1043480 Valid Authentication Medium 2021-02-15 – 31 Uncontrolled Resource Consumption in any Markdown field using Mermaid #670572 Valid Denial of Service Medium 2019-12-20 – 31 GitLab's GitHub integration is vulnerable to SSRF vulnerability #446593 Valid Server-Side Request Forgery Medium 2019-08-30 $2,000 30 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet #1751258 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,730 29 Stored XSS in repository file viewer #1072868 Valid Cross-site Scripting Medium 2022-05-19 $2,000 29 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure Medium 2021-01-08 – 29 Drive-by arbitrary file deletion in the GDK via letter_opener_web gem #1353103 Valid Cross-Site Request Forgery Medium 2021-11-12 $750 27 Stored XSS in group issue list #859333 Valid Cross-site Scripting Medium 2020-11-21 $2,000 27 Stored XSS on PyPi simple API endpoint #856836 Valid Cross-site Scripting Medium 2020-09-09 $3,000 25 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure Medium 2020-11-21 – 24 Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure Medium 2018-12-03 – 24 ReDoS due to device-detector parsing user agents #1772063 Valid Denial of Service Medium 2024-10-08 – 23 Attacker can create malicious child epics linked to a victim's epic in an unrelated group #1892200 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,160 22 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control Medium 2021-10-18 $600 21 [Markdown] Stored XSS via character encoding parser bypass #270999 Valid Cross-site Scripting Medium 2017-10-18 – 20 CSV injection in gitlab.com via issues export feature. #216243 Valid Command and Code Injection Medium 2017-07-21 – 20 SSRF vulnerability in gitlab.com via project import. #215105 Valid Server-Side Request Forgery Medium 2017-11-09 – 20 DOS via move_issue #1543584 Valid Denial of Service Medium 2022-11-04 $2,300 19 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control Medium 2022-09-22 – 17 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection Medium 2022-02-10 – 15 Gitlab Pages token theft using service workers #1439552 Valid Access Control Medium 2022-06-08 $1,680 14 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery Medium 2020-08-17 – 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control Medium 2019-04-05 – 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control Medium 2022-06-08 – 13 ReDoS in syntax highlighting due to Rouge #1283484 Valid Denial of Service Medium 2021-11-15 $600 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control Medium 2020-10-06 – 13