Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-13270: GitLab lets guests link forks on restricted public projects
CVE-2020-13270 · published 6 years ago
Summary
In GitLab versions 11.3 through 13.0.1, a missing permission check lets anyone with a guest account create a fork relationship on public projects that are meant to be restricted, using the API. This can expose project structure or cause confusion about code ownership. Upgrade GitLab to a version that includes the fix or apply the provided patch and limit API access for guest users.
What to do
- Update gitlab to version 13.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 13.0.0, < 13.0.1 Fix: upgrade to 13.0.1
|
| – | gitlab | gitlab |
>= 11.3.0, < 11.9.8 >= 11.3.0, < 12.9.8 >= 12.10.0, < 12.10.7 >= 13.0.0, < 13.0.1 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13270 URL
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13270.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/24648 Broken Link Vendor Advisory
- https://hackerone.com/reports/419977 Permissions Required Third Party Advisory
Severity
8.8
High
Type
CWE-862Missing Authorization
Timeline
Published10 Jun 2020
Updated4 Nov 2026
First seen10 Sep 2026
Track software like this
Free during beta