CVE-2021-22263

An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects.

• CWE-269

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/331473Exploit, Issue Tracking, Vendor Advisory
• https://hackerone.com/reports/1193062Exploit, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22263.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/331473Exploit, Issue Tracking, Vendor Advisory
• https://hackerone.com/reports/1193062Exploit, Third Party Advisory

Published

Oct 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22258The project import/export feature in GitLab 8.9 and greater …4.3
• CVE-2021-22259A potential DOS vulnerability was discovered in GitLab EE st…6.5
• CVE-2021-2226Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-22260A stored Cross-Site Scripting vulnerability in the DataDog i…5.4
• CVE-2021-22261A stored Cross-Site Scripting vulnerability in the Jira inte…4.8
• CVE-2021-22262Missing access control in all GitLab versions starting from …4.3
• CVE-2021-22264An issue has been discovered in GitLab affecting all version…6.5
• CVE-2021-22267Idelji Web ViewPoint Suite, as used in conjunction with HPE …5.9
• CVE-2021-2227Vulnerability in the Oracle Cash Management product of Oracl…8.1
• CVE-2021-22272The vulnerability origins in the commissioning process where…9.4
• CVE-2021-22275Buffer Overflow vulnerability in B&R Automation Runtime webs…8.6
• CVE-2021-22276The vulnerability allows a successful attacker to bypass the…5.5