API5:2023 â Broken Function Level Authorization Â· Slide 13 of 28

Slide 13 · Real Incident: Unauthenticated Admin Function

No login required. All users. All emails. All at once.

GitLab, 2021 — a GraphQL function that should have required admin access required nothing.

Real Incident · 2021 · CVE-2021-4191

GitLab — Unauthenticated User Enumeration via GraphQL API

GitLab is a code hosting platform used by millions of developers and organizations. Its API includes a GraphQL endpoint at /api/graphql that supports a wide range of queries.

Security researcher Nir Ohfeld at Rapid7 discovered that a specific GraphQL query — one that enumerates all registered users, their usernames, and email addresses — required no authentication whatsoever. The endpoint itself was open to unauthenticated callers, and the user enumeration query was not restricted to admin-role tokens.

The query returned: username, name, email address, and user ID for every registered user on the instance. On GitLab.com, this meant the personal details of millions of users were enumerable without any login.

GitLab patched CVE-2021-4191 in GitLab versions 14.7.7, 14.8.5, and 14.9.2. The patch added authentication requirements to the affected GraphQL resolvers and restricted user enumeration to administrator-role tokens only. Self-hosted GitLab instances that had not updated remained exposed until patched.

Lesson: Every API function that returns sensitive data — especially bulk user data — must have explicit authorization requirements defined. GraphQL APIs are particularly prone to this because the schema exposes many query capabilities from a single endpoint; each resolver must individually enforce its own authorization requirements.

← Back See it in attack scenarios →