CVE-2022-0390

MEDIUM 4.3CVE-2022-0390 · Published 01/04/2022 · updated 17/06/2026

In short

CVE-2022-0390 is a MEDIUM (CVSS 4.3) vulnerability affecting gitlab (gitlab).
Chance of exploitation in the next 30 days (EPSS): 0.91%, higher than 60.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
gitlab gitlab	`= 14.7.0≥ 12.7.0, ≤ 14.5.4≥ 14.6.0, ≤ 14.6.4`	No fix yet

Description

Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0390.json · Third Party Advisory
gitlab.com/gitlab-org/gitlab/-/issues/330030 · Exploit
hackerone.com/reports/1179733 · Permissions Required

More vulnerabilities in gitlab

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gitlab

= 14.7.0≥ 12.7.0, ≤ 14.5.4≥ 14.6.0, ≤ 14.6.4

No fix yet

More vulnerabilities in gitlab

See all →