CVE-2021-39904

MediumCVSS 4.3

Published: 05/11/2021(UTC)Updated: 12/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

31th percentile - higher than 31% of all known CVEs

Summary

CVE-2021-39904 describes an improper access control vulnerability in the GraphQL API in all versions of GitLab CE/EE from 13.1 to 14.2.6, from 14.3 to 14.3.4, and from 14.4 to 14.4.1. This allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request.

Risk Assessment

The organization may be exposed to unauthorized changes in Merge Requests, potentially leading to unintended code modifications and reduced project security.

Recommendation

It is recommended to update GitLab to the latest version to mitigate this vulnerability and review the access policy for Merge Requests.

Original NVD description (English source)

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request