CVE-2020-13300

CRITICAL

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.

Affects 1 product across 1 vendor.

CVSS 3.110.0
EPSS1.3%
Percentile69th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-863: Incorrect Authorization

Software performs an authorization check incorrectly, allowing access beyond intended privileges.

◆ AI Analysis — automated analysis, not human-reviewed

GitLab Community Edition and Enterprise Edition versions 13.3 prior to 13.3.4 are vulnerable to an OAuth authorization scope change without user consent, allowing unauthorized access to user data.

BSID: BS-2020-GLOBAL-343971-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-13300?
GitLab Community Edition and Enterprise Edition versions 13.3 prior to 13.3.4 are vulnerable to an OAuth authorization scope change without user consent, allowing unauthorized access to user data.
What is the CVSS score for CVE-2020-13300?
CVE-2020-13300 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS: 1.3%.
Is CVE-2020-13300 actively exploited?
No confirmed active exploitation of CVE-2020-13300 as of 2026-05-30.
How do I remediate CVE-2020-13300?
Priority: IMMEDIATE. PSIRT: [email protected]
What systems are affected by CVE-2020-13300?
CVE-2020-13300 affects Gitlab Gitlab.
Vulnerability Details
CVE IDCVE-2020-13300
BSIDBS-2020-GLOBAL-343971-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Published2020-09-14
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Incorrect Authorization
Domains
CLOUD
SourceNVD
Official Description

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could manipulate the OAuth authorization flow to request additional scopes beyond what the user initially consented to, potentially gaining access to sensitive user information.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Gitlab Gitlab ≥ 13.3.0, < 13.3.4
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2234 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasha9d019b001b51ade9923a4d72d1afe1597f606b2eab139e2863b397c693889d452d550fa516aab1878639b2132b8076b19ccd5caa20059f011d4a4bf6ab6c239
Related CVEs affecting Gitlab
CVE-2021-22205 10.0 An issue has been discovered in GitLab CE/EE affecting all versions starting ... CVE-2019-9174 10.0 An issue was discovered in GitLab Community and Enterprise Edition before 11.... CVE-2026-85706 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18... CVE-2026-97229 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19... CVE-2018-18843 10.0 The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 1...
View all Gitlab CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →