CVE-2026-92530

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4

Description An issue exists where an authenticated user can spoof merge request authorship and attribute content to arbitrary existing users on the target instance. This occurs during Direct Transfer imports due to improper reliance on ephemeral cache state, which is a temporary storage area used to hold data for short-term access.

Recommendations Update GitLab CE/EE versions 19.1 through 19.2.6 to version 19.2.7. Update GitLab CE/EE versions 19.3 through 19.3.2 to version 19.3.3. Update GitLab CE/EE version 19.4 to version 19.4.1.