CVE-2021-39904

What it actually does

Authorization bypass in the GraphQL API permits a merge request creator to resolve discussions and apply suggestions even after the project owner has locked the merge request.

Why it matters to the business

Locked merge requests can still be altered by their original creators, undermining review controls and potentially allowing unapproved code changes to reach protected branches in projects using the affected software.

How an attack unfolds

An attacker creates a merge request, waits for the project owner to lock it, then issues GraphQL queries that bypass the lock to resolve discussions or apply suggestions directly.

How to fix it

Upgrade to a version containing commit 2a3f5e988be6a2c7dae5ac22b9e86d579b462f4c or later; verify the fix is present in all deployed instances of the software.

How to confirm the fix worked

Confirm the deployed version includes commit 2a3f5e988be6a2c7dae5ac22b9e86d579b462f4c; test that locked merge requests reject resolution and suggestion actions via the GraphQL API.

Typical attack path

1. Create a merge request in the target project
2. Wait for project owner to apply a lock on the merge request
3. Issue crafted GraphQL mutations to resolve discussions or apply suggestions
4. Confirm changes persist despite the lock state

How to detect it

Search application and GraphQL access logs for mutations targeting discussion resolution or suggestion application on merge requests that have lock timestamps; correlate with user activity after lock events.

What your security team should do

• Apply the listed commit or newer release immediately to all instances
• Audit recent merge request activity for post-lock modifications
• Review GraphQL access logs for unusual discussion or suggestion operations on locked items
• Enforce merge request locking policies with additional branch protection where feasible