CVE-2021-39881
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the mal…
Published: 2021-10-05 · CVSS: 3.5 · CVSS 3.1
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7