CVE-2021-39881

LOW

In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick...

Affects 1 product across 1 vendor.

CVSS 3.13.5
EPSS0.9%
Percentile58th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, requires user interaction, impact contained to the vulnerable component, no confidentiality impact, no availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2021. A low severity vulnerability affects Gitlab systems (CVE-2021-39881). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2021-GLOBAL-306402-L • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-39881?
This vulnerability was disclosed in 2021. A low severity vulnerability affects Gitlab systems (CVE-2021-39881). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2021-39881?
CVE-2021-39881 has CVSS 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS: 0.9%.
Is CVE-2021-39881 actively exploited?
No confirmed active exploitation of CVE-2021-39881 as of 2026-05-30.
How do I remediate CVE-2021-39881?
Priority: MONITOR. Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/26695 PSIRT: [email protected]
What systems are affected by CVE-2021-39881?
CVE-2021-39881 affects Gitlab Gitlab.
Vulnerability Details
CVE IDCVE-2021-39881
BSIDBS-2021-GLOBAL-306402-L BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Published2021-10-05
Last Modified2024-11-21
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Gitlab Gitlab ≥ 7.7.0, < 14.1.7 ≥ 14.2.0, < 14.2.5 ≥ 14.3.0, < 14.3.1
Remediation
View Vendor Advisory →

Remediation Priority: MONITOR

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1836 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashc6680d3116b223eff8758da796dc4a71d5f28d421f50bff176b129d9f85f03934b0523017fbfc65d9a6df4f7c3926ce85de65ddb4ed9d7128fdacc027d13d796
Related CVEs affecting Gitlab
CVE-2026-85706 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18... CVE-2021-22205 10.0 An issue has been discovered in GitLab CE/EE affecting all versions starting ... CVE-2019-9174 10.0 An issue was discovered in GitLab Community and Enterprise Edition before 11.... CVE-2020-13300 10.0 GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authoriz... CVE-2018-18843 10.0 The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 1...
View all Gitlab CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →