# Improper access control for users with expired password, giving the user full access through API and Git

GitLab's LDAP fix regressed expired-password enforcement, letting users with expired passwords still access REST, GraphQL, and Git via tokens.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: joaxcar
- Disclosed: 2022-01-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1285226
- Library page: https://bugbountylibrary.com/r/h1%3A1285226
- Tags: area:web3 domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:graphql tech:rest technique:incomplete-fix technique:regression vuln:access-control vuln:auth-bypass

**Target:** GitLab self-hosted REST/GraphQL API and Git HTTP
**Root cause:** A merge request fixing LDAP expired-password handling re-opened access for regular accounts, so expired-password state is no longer enforced on API/Git token requests.
**Steps:**
1. Create user01, log in, create a private project, note its ID.
2. Create a personal access token at /-/profile/personal_access_tokens.
3. As admin, edit user01 and change password to trigger 'password expired at'.
4. Log in as user01 with new password; stop at 'enter a new password' page (do not set new password).
5. Use the token: `curl -H 'Authorization: Bearer <TOKEN>' https://gitlab.domain.com/api/v4/projects/:ID` returns the private project.
**How found:** Researcher tracked prior patches (13.12.2, 14.0.2) that blocked expired-password API access, noticed a later LDAP-fix merge request, and hypothesized it regressed enforcement, then tested REST/GraphQL/Git with an expired-password token.
**Exploitation:** An attacker holding a token for an account whose password was expired (e.g. after admin reset) continues to use REST, GraphQL, and Git over HTTP to read private projects instead of being forced to reset the password.
**Insight:** When a vendor ships a fix for one auth path (LDAP), retest the sibling enforcement paths (REST, GraphQL, Git HTTP) it touched; regression of a prior security patch is a reliable bug source.