CVE-2026-92530

Published: Sep 24, 2026Modified: Sep 28, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	19.1.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	19.1.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	Version 19.4.0
Gitlab Gitlab	Version 19.4.0

Related CWEs

CWE-348

Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References (2)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/628379

Source: cve@gitlab.com

Broken Link

Timeline

No history available yet.