Vulnerability record · CVE-2021-4191 · published 28 March 2022

CVE-2021-4191: GitLab GraphQL API user enumeration on restricted-signup instances

Gitlab · Gitlab

GitLab CE/EE versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2 expose a user enumeration flaw in the GraphQL API. On private instances with restricted sign-ups, an unauthenticated attacker can determine which usernames exist. This matters because it leaks account information that can feed credential attacks or social engineering.

5.3 CVSS 3.1 Medium EPSS 80% · top 0.4%

5.3CVSS 3.1 base score, v2 5.0

80%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS is medium (5.3) and impact is limited to information disclosure, but the very high EPSS and unauthenticated network reach make it worth prompt patching.

What it is

Impact

An attacker gains confirmation of valid usernames on the target GitLab instance. No data beyond account existence is exposed, but it enables targeted follow-on attacks.

Attack surface

Reachable over the network through the GraphQL API with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw only applies to private GitLab instances that have restricted sign-ups enabled.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.80004 probability, 99.593 percentile), and references are vendor advisory, a broken issue link, and a HackerOne report marked Permissions Required, so no public exploit code is confirmed in this record.

What to do

Upgrade GitLab CE/EE to a release after 14.6.5, 14.7.4, or 14.8.2 as applicable to your branch.
If immediate upgrade is not possible, restrict network access to the GraphQL API to trusted users or networks.
Review whether restricted sign-ups are required; disabling that configuration removes the described exposure.
Monitor GitLab security advisories for the fixed release matching your version line.

Detection

Alert on high-volume or automated GraphQL queries from unauthenticated sources, especially those probing user or username fields.
Baseline normal GraphQL API request patterns and flag enumeration-like sequences from single IPs or sessions.
Correlate GitLab authentication logs for failed logins using usernames that first appeared in GraphQL enumeration traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Gitlab Gitlab

References

Link	Tags
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898	Broken Link
https://hackerone.com/reports/1089609	Permissions RequiredThird Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/343898	Broken Link
https://hackerone.com/reports/1089609	Permissions RequiredThird Party Advisory

Track CVE-2021-4191 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-85706GitLab CE/EE repository commits API path traversal allows unauthenticated file readGitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated use…KEVEPSS 91%analysed12 Sep 2026 10.0CVE-2021-22205GitLab CE/EE image parser flaw allows unauthenticated remote code executionGitLab CE/EE failed to properly validate image files passed to a file parser, allowing code injection that leads to remote command execution. The fla…KEVEPSS 100%analysed23 Apr 2021 9.8CVE-2023-7028GitLab CE/EE password reset sent to unverified email, enabling account takeoverGitLab CE/EE versions from 16.1 through 16.7 before their fixed releases could deliver account password reset emails to an unverified email address. …KEVEPSS 95%analysed12 Jan 2024 9.8CVE-2021-22175GitLab unauthenticated SSRF via internal webhook requestsGitLab is vulnerable to server-side request forgery when requests to the internal network for webhooks are enabled. The flaw affects all versions sta…KEVEPSS 53%analysed11 Jun 2021 7.5CVE-2021-39935GitLab CI Lint API server-side request forgeryGitLab CE/EE contains a server-side request forgery flaw in the CI Lint API affecting versions from 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 …KEVEPSS 36%analysed13 Dec 2021 10.0CVE-2020-13300Gitlab incorrect authorization vulnerabilityGitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorizati…EPSS 1.3%14 Sep 2020 10.0CVE-2019-9174Gitlab server-side request forgery (ssrf) vulnerabilityAn issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.EPSS 2.0%17 Apr 2019 10.0CVE-2018-18843Gitlab server-side request forgery (ssrf) vulnerabilityThe Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.EPSS 1.6%4 Dec 2018

Source: NIST National Vulnerability Database (record CVE-2021-4191), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.