Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.
CWE-863
CVE-2021-22239
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
CVE-2021-22240
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled
CVE-2021-22243
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
CVE-2021-22247
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
CVE-2021-22251
Improper validation of invited users’ email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings