PT-2026-97619
CVE-2026-92530
·
تاريخ النشر
2026-09-23
·
تاريخ التحديث
2026-09-29
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
GitLab CE/EE versions 19.1 through 19.2.6
GitLab CE/EE versions 19.3 through 19.3.2
GitLab CE/EE versions 19.4
Description
An issue exists where an authenticated user can spoof merge request authorship and attribute content to arbitrary existing users on the target instance. This occurs during Direct Transfer imports due to improper reliance on ephemeral cache state, which is a temporary storage area used to hold data for short-term access.
Recommendations
Update GitLab CE/EE versions 19.1 through 19.2.6 to version 19.2.7.
Update GitLab CE/EE versions 19.3 through 19.3.2 to version 19.3.3.
Update GitLab CE/EE version 19.4 to version 19.4.1.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾