CVE-2020-5415: GitLab auth uses full name instead of username as user ID, allowing impersonation

December 20, 2021 (updated July 22, 2025)

Installations which use the GitLab auth connector are vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under users in the team configuration or given to the --gitlab-user flag.

See the GitLab auth docs for details.

Concourse installations which do not configure the GitLab auth connector are not affected.

References

github.com/advisories/GHSA-627p-rr78-99rj
github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj
nvd.nist.gov/vuln/detail/CVE-2020-5415
tanzu.vmware.com/security/cve-2020-5415

Code Behaviors & Features

Detect and mitigate CVE-2020-5415 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →