CVE-2021-39891: 
GitLab vulnerability analysis and mitigation

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure (GitLab Security Release).

The vulnerability has been assigned CVE-2021-39891 and received a CVSS v3.1 Base Score of 5.9 MEDIUM (Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) from GitLab Inc., while the NVD assessment rated it as 4.9 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). The vulnerability is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) (NVD CVE).

The vulnerability could lead to sensitive information disclosure as access tokens created during admin impersonation remain active after the impersonation session ends (GitLab Security Release).

The vulnerability has been fixed in versions 14.3.1, 14.2.5, and 14.1.7 of GitLab Community Edition (CE) and Enterprise Edition (EE). Users are strongly recommended to upgrade to one of these versions immediately (GitLab Security Release).

The vulnerability was discovered internally by a member of the GitLab team and was addressed as part of a larger security release that included multiple other security fixes (GitLab Security Release).