Medium
Security advisory
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-22221
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:27 UTC · Revision 1
Source evidence
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired
osv:CVE-2021-22221
Complete source record
{
"id": "5e723b1293f2af6e5a4d2b34dea583ef10df9cc26f5fd268983a3e6af71eb46a",
"url": "https://osv.dev/vulnerability/CVE-2021-22221",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-22221",
"summary": "An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired",
"evidence": "osv:CVE-2021-22221",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-22221",
"aliases": [
"BIT-gitlab-2021-22221",
"CVE-2021-22221"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/gitlab-org/gitlab",
"type": "GIT",
"events": [
{
"introduced": "073a4ba8016203c9e48595afd3ddea430d9420a3"
},
{
"fixed": "7327f6c9bf4fa71bc518992f995cc7648c102c07"
},
{
"introduced": "47f41a4a74f364c731aafd34a93bddb630f62230"
},
{
"fixed": "d6e2cf8d41eceec30c20b921d9779bbd539ae594"
},
{
"introduced": "12a3ec8fb4a540576b2d47247bc86ea7e2c7565b"
},
{
"fixed": "865a93b831bfcc63d49d6f2d14ccfafe216e4a99"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "12.9.0"
},
{
"fixed": "13.10.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "12.9.0"
},
{
"fixed": "13.10.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "13.11.0"
},
{
"fixed": "13.11.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "13.11.0"
},
{
"fixed": "13.11.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "13.12.0"
},
{
"fixed": "13.12.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "13.12.0"
},
{
"fixed": "13.12.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v13.11.4-ee",
"v13.12.1-ee",
"v13.11.3-ee",
"v13.12.0-ee",
"v13.11.1-ee",
"v13.11.0-ee"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22221.json"
}
}
],
"modified": "2026-10-30T10:30:58.826935823Z",
"provider": "osv",
"references": [
"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22221.json",
"https://gitlab.com/gitlab-org/gitlab/-/issues/292006"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-22221",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437938,
"published_at": "2021-06-08T19:15:08.163+00:00"
}