CVE-2022-3870 in Community Edition
Summary
by MITRE • 01/12/2023
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability in GitLab CE/EE represents a critical information disclosure flaw that undermines the privacy protections of private instances. The issue affects versions from 10.0 through 15.5.6, 15.6.0 through 15.6.3, and 15.7.0 through 15.7.1, creating a persistent security gap that has been exploited by attackers seeking unauthorized access to user data. The vulnerability specifically targets private GitLab installations where public visibility is restricted, yet still allows unauthenticated users to access user avatars through direct exploitation of the user ID parameter. This flaw directly violates the principle of least privilege and demonstrates a failure in access control mechanisms that should prevent unauthorized data retrieval.
The technical implementation of this vulnerability stems from improper validation of user authentication status when processing avatar download requests. Attackers can construct malicious URLs using victim user IDs to bypass the normal authentication checks that should prevent access to private user data. This type of vulnerability aligns with CWE-284, which addresses improper access control, and specifically relates to the lack of proper authorization validation for resource access. The flaw operates at the application layer and exploits the absence of adequate input sanitization and access control enforcement mechanisms within GitLab's avatar handling system. The vulnerability can be categorized under ATT&CK technique T1213.002, which involves data from information repositories, specifically targeting user profile information that should remain protected within private instances.
The operational impact of this vulnerability extends beyond simple information disclosure, as avatar images often contain metadata or can be used as part of social engineering attacks. An attacker could potentially gather intelligence about users by accessing their profile images, which may reveal personal information or be used to craft more convincing phishing attempts. The vulnerability affects all private GitLab instances regardless of their size or user base, making it particularly dangerous for organizations that rely on GitLab for sensitive code repositories and user management. The attack vector requires no authentication credentials, making it accessible to anyone with knowledge of the target instance and user IDs, which can be easily enumerated through various reconnaissance techniques. This vulnerability essentially provides a backdoor into private user data that should remain protected, undermining the fundamental security model of GitLab private instances.
Organizations affected by this vulnerability should immediately implement the available patches for their GitLab installations, particularly upgrading to versions 15.5.7, 15.6.4, or 15.7.2, depending on their current version. System administrators should also consider implementing network-level restrictions to limit access to avatar endpoints, though this should not be considered a substitute for proper patching. The vulnerability highlights the importance of regular security updates and proper access control implementation within web applications. Additional mitigations include monitoring for unusual access patterns to avatar endpoints and implementing more robust authentication checks for all user profile data access. Organizations should also conduct thorough security assessments of their GitLab installations to identify other potential access control vulnerabilities that may exist within their deployment. The incident underscores the critical need for maintaining up-to-date security practices and the potential consequences of failing to address known vulnerabilities in widely-used software platforms.