← Database

CVE-2021-39889

MEDIUM CVSS: 4.3 Published: 2021-10-05 Modified: 2026-06-17

Description

In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.

Affected Platforms

Gitlab Gitlab

Weakness Type

CWE-639

References