CVE-2021-39891

5.9 MEDIUM

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at th...

Published: 2021-10-05 · Last updated: 2026-06-17

Severity and scoring

CVSS: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-212

Affected products

Vendor	Product
gitlab	gitlab

Description

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-39891
[Vendor advisory]https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json
[Other]https://gitlab.com/gitlab-org/gitlab/-/issues/335137
[Vendor advisory]https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json
[Other]https://gitlab.com/gitlab-org/gitlab/-/issues/335137

Related CVEs

Same vendor

CVE-2026-9694 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.... (2.6 LOW)
CVE-2026-9204 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19... (5.3 MEDIUM)
CVE-2026-8589 — GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0... (7.3 HIGH)
CVE-2026-7250 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19... (7.5 HIGH)
CVE-2026-6976 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.... (3.7 LOW)

Same CWE

CVE-2026-54421 — In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can re... (6.8 MEDIUM)
CVE-2026-46657 — Bludit is a content management system (7.1 HIGH)
CVE-2026-36178 — The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition,... (4.6 MEDIUM)
CVE-2026-45046 — Gryph provides a security layer for AI coding agents (5.5 MEDIUM)
CVE-2026-27892 — FacturaScripts is an open source accounting and invoicing software (6.5 MEDIUM)