CVE-2021-39901: GitLab

Low severity, CVSS 2.7. EPSS: 0.9% chance of exploitation in the next 30 days.

In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

Affected products

• GitLab GitLab: from 11.10.0, before 14.2.6 (fixed in 14.2.6); from 14.3.0, before 14.3.4 (fixed in 14.3.4); version 14.4.0 only

Published 2021-11-05. Last modified 2026-06-17.