CVE-2021-39872

Summary dbcve.org

In GitLab CE/EE versions 14.1 and later, an improper access control vulnerability allows users with expired passwords to continue accessing GitLab through git operations and the API using access tokens that were acquired before their password expired. The access tokens remain valid even after the associated password becomes invalid, bypassing password expiration controls.

Mitigation

Implement token validation that checks password status at authentication time, ensuring access tokens are invalidated when the user's password expires, and establish token expiration policies aligned with password rotation requirements.