LiveActive security incident?Get immediate response
CVE Record

CVE-2021-22249: A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email add...

A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This GitLab EE issue could reveal a private email address through an overly detailed error message when a user is invited to a group. The business impact is privacy exposure, not system takeover. It matters most for organizations where GitLab account email privacy protects employees, customers, researchers, or sensitive projects.

Executive priority

Handle through normal vulnerability remediation, with higher urgency if GitLab contains sensitive user populations or email privacy is a compliance concern. This is not described as remote code execution or active exploitation, but it can create privacy and trust risk.

Technical view

CVE-2021-22249 affects GitLab EE versions >=12.2 and below 13.12.9, 14.0.7, and 14.1.2. The source describes verbose group-invitation error handling disclosing the invited user’s private email address. CVSS 3.1 is 4.3, network-accessible, low complexity, low privileges required, confidentiality-only impact.

Likely exposure

Exposure is likely limited to self-managed GitLab EE deployments running the listed affected versions and using group invitation workflows. The bundle does not identify affected SaaS status, CPEs, or any broader product family beyond GitLab EE.

Exploitation context

The issue was publicly reported through GitLab and HackerOne references. The source bundle marks KEV as false and provides no evidence of active exploitation. Treat exploit status as unconfirmed, not actively exploited.

Researcher notes

No CWE is listed in the bundle, and no CPE data is provided. The vulnerability has unchanged scope, requires low privileges, and impacts confidentiality only. Evidence supports email disclosure via verbose errors, but not integrity loss, availability impact, or active exploitation.

Mitigation direction

  • Upgrade GitLab EE to a version outside the affected ranges.
  • Prioritize 13.12.9, 14.0.7, 14.1.2, or later within your release track.
  • Review GitLab’s linked issue and CVE record for vendor guidance.
  • Limit group invitation permissions where email privacy is operationally sensitive.
  • Notify privacy stakeholders if logs or reports show unintended disclosure.

Validation and detection

  • Inventory all self-managed GitLab EE instances and versions.
  • Compare versions against >=12.2 <13.12.9, >=14.0 <14.0.7, and >=14.1 <14.1.2.
  • Confirm whether group invitations are enabled or delegated broadly.
  • Review recent invitation-related errors for private email exposure.
  • Document remediation status and any privacy-impact assessment.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-22249 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2021-22249Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GitLabGitLab>=12.2, <13.12.9, >=14.0, <14.0.7, >=14.1, <14.1.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.