An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior…

Published 4 y ago 2022-07-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

2.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.8%

percentile 57%

Public exploits

none known

An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the 'Invite a group' feature to invite a group that has members that don't comply with domain allow-list.

Exploit prediction (EPSS)

0.80% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N`
CNA	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N`
NVD	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`

Affected products

GitLab GitLab

Classification

Weakness

CWE-863 Incorrect Authorization

Technology feeds

GitLab (RSS, critical only)

References

gitlab.com /gitlab-org/gitlab/-/issues/354791 · x_refsource_MISC, x_transferred
hackerone.com /reports/1501733 · x_refsource_MISC, x_transferred
gitlab.com /gitlab-org/cves/-/blob/master/2022/CVE-2022-1981.json · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2022-1981
NVD: CVE-2022-1981

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.