{"id":"CVE-2021-4191","published":"2022-03-28T18:53:12Z","modified":"2024-08-03T17:16:04Z","title":"An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">=14.8, <14.8.2",">=14.7, <14.7.4",">=13.0, <14.6.5"]}],"description":{"text":"An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.","provenance":"source","from":"CVE.org"},"summary":{"text":"GitLab CE/EE contains a flaw in its GraphQL API that affects private instances with restricted sign-ups. The issue is present in the affected GitLab releases covered by the advisory, which span versions 13.0 through 14.8.2. An unauthenticated attacker with network access to the instance can send GraphQL API requests to enumerate existing user accounts, and no user interaction or prior authentication is required. The exposure is limited to instances that restrict sign-ups, and the attack depends on the GraphQL endpoint being reachable.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:22Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.80004,"percentile":0.99613,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-14","exploitedFirstSeen":"2023-11-14","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-23&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-24&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-25&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-27&host_type=src&vulnerability=cve-2021-4191","date":"2023-11-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-01&host_type=src&vulnerability=cve-2021-4191","date":"2023-12-01"}],"evidenceTotal":583,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Vulnerabilities in GitLab Products","url":"https://otx.alienvault.com/pulse/624af6fd603f1883d9b1d32b","created":"2022-04-04"},{"name":"TM Feed 07032022","url":"https://otx.alienvault.com/pulse/6228a952b8527c6374dfec52","created":"2022-03-09"},{"name":"GitLab GraphQL API User Enumeration Fixed in GitLab That Could Lead to Recovery of User-related Info","url":"https://otx.alienvault.com/pulse/6225fc95786fc00cfe65ac5c","created":"2022-03-07"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/343898","tags":["x_refsource_MISC"]},{"url":"https://hackerone.com/reports/1089609","tags":["x_refsource_MISC"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-34051","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34051","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"GitLab GraphQL API User Enumeration","module":"auxiliary/scanner/http/gitlab_graphql_user_enum","type":"auxiliary","disclosureDate":"2022-02-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/gitlab_graphql_user_enum.rb"}],"nuclei":[{"id":"CVE-2021-4191","name":"GitLab GraphQL API User Enumeration","severity":"medium","path":"http/cves/2021/CVE-2021-4191.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4191.yaml"}],"first":{"date":"2022-02-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/gitlab_graphql_user_enum.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-02-25","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/gitlab_graphql_user_enum.rb","provenance":"source"},{"date":"2022-03-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4191","provenance":"source"},{"date":"2023-11-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2021-4191","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":65.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1082 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}