CVE-2022-1124 — An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled

Back Back to CVE browser

MEDIUM

An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled

Published May 11, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.87%

Description

An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  <14.8.6
  Status
  affected
  Constraints
  -
- Version
  >=14.10.0, <14.10.1
  Status
  affected
  Constraints
  -
- Version
  >=14.9.0, <14.9.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
<14.8.6	affected	-
>=14.10.0, <14.10.1	affected	-
>=14.9.0, <14.9.4	affected	-

Remediation

No remediation recorded yet.

Metrics

0.87% 0.00871

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00871

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.87% (0.00871)	57.42th	v5 (v2026.06.15)
Jun 15, 2026	0.69% (0.00686)	47.63th	v5 (v2026.06.15)
Mar 17, 2025	0.11% (0.00114)	27.64th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00067)	31.70th	v3 (v2023.03.01)
Jul 10, 2024	0.07% (0.00067)	29.90th	v3 (v2023.03.01)
Mar 27, 2024	0.07% (0.00067)	27.84th	v3 (v2023.03.01)
Apr 11, 2023	0.08% (0.00080)	32.79th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00074)	30.01th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00890)	30.33th	v2 (v2022.01.01)
Oct 26, 2022	0.89% (0.00890)	29.12th	v2 (v2022.01.01)
May 12, 2022	0.89% (0.00890)	27.12th	v2 (v2022.01.01)

Weaknesses (1)

CWE-863

Incorrect Authorization

References (3)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1124.json
x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/323552
x_refsource_MISCBroken Link
https://hackerone.com/reports/1113405
x_refsource_MISCPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1124.json		x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/323552		x_refsource_MISCBroken Link
https://hackerone.com/reports/1113405		x_refsource_MISCPermissions RequiredThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published May 11, 2022

Updated Aug 2, 2024

Reserved Mar 28, 2022

Link CVE-2022-1124

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-1124

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-1124