CVE-2021-39890: GitLab

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.

Affected products

• GitLab GitLab: from 14.1.1, before 14.1.7 (fixed in 14.1.7); from 14.2.0, before 14.2.5 (fixed in 14.2.5); version 14.3.0 only; version 14.3.1 only

Published 2021-12-06. Last modified 2026-06-17.