EUVD-2026-85735
GHSA-wr3r-jhmc-f6jw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user with import rights
-
DeliveryInitiate Direct Transfer import
-
ExploitManipulate ephemeral cache state during import
-
ExecutionImport processes MR with stale author binding
-
ImpactMerge request attributed to arbitrary existing user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication IP-independent access control
|
| Exploitation Conditions | Requires an authenticated user (PR:L) with the ability to perform a GitLab Direct Transfer import (group/project migration by direct transfer must be enabled and available to the attacker). The flaw is triggered only 'under certain conditions' involving improper reliance on ephemeral cache state during the import, indicating a timing/state dependency rather than a deterministic path - this materially limits reliable exploitation. Impact is limited to spoofing merge-request authorship/attribution to existing users on the same target instance; no confidentiality or availability effect. Affected only on GitLab CE/EE 19.1-19.2.6, 19.3-19.3.2, and 19.4.0. |
| Impact | This is a genuinely low-priority finding despite being a valid, vendor-confirmed vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) reflects an integrity-only impact: an authenticated user can forge merge-request authorship, but there is no confidentiality or availability impact and no scope change. No EPSS score, no CISA KEV listing, and no public POC are present in the input, and no SSVC decision data is provided - meaning there is no signal of active or automatable exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The one point of tension is the vendor's AC:L: the description explicitly says the flaw only manifests 'under certain conditions' via 'improper reliance on ephemeral cache state,' which points to a timing/race dependency more consistent with AC:H - verify the exact trigger with GitLab work-item 628379. Net: a real, correctly-attributed integrity/spoofing issue worth patching in routine cycles, but not an urgent, widely-weaponizable priority. |
| Exploit ScenarioDerived | An authenticated user with import privileges initiates a GitLab Direct Transfer (group/project) import and, by exploiting stale ephemeral cache state during the import, causes merge requests and their content to be attributed to an arbitrary existing user on the target instance - enabling social-engineering or repudiation attacks where malicious changes appear authored by a trusted colleague. No public exploit code is identified, and the 'certain conditions' wording suggests reliable triggering requires specific import timing/state. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Merge request authorship spoofing in GitLab CE/EE 19.1 through 19.4.0 lets an authenticated user who can perform a Direct Transfer import attribute merge request content to arbitrary existing users on the target instance. Exploitation requires a valid account with the ability to run a direct-transfer migration and depends on a timing/state condition in ephemeral cache handling, so it is not deterministic; the assessed impact is integrity-only with no confidentiality or availability effect, and no public exploit identified at time of analysis. GitLab has shipped fixed releases 19.2.7, 19.3.3, and 19.4.1.
RemediationAI
Upgrade to a fixed release as soon as practical: GitLab CE/EE 19.2.7, 19.3.3, or 19.4.1 (vendor-released patch versions, per https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/ and https://gitlab.com/gitlab-org/gitlab/-/work_items/628379); upgrading to the latest patch in the 19.4 line is preferred since 19.2.7/19.3.3 are the maintenance backports. If immediate upgrade is not possible, disable Direct Transfer as an import source for non-administrative users via the Admin Area import source settings so that migrations can only be initiated by trusted administrators, and review/audit recent Direct Transfer-imported merge requests for authorship anomalies - the trade-off is that legitimate self-service group/project migration from another GitLab instance will be unavailable until the control is lifted. Because exploitation is authenticated and gated on Direct Transfer availability plus a timing/state condition, restricting import permissions to a small, monitored admin group is an effective and low-disruption interim control. There is no public exploit code identified, so emergency out-of-band action is not indicated; schedule the patch in the normal maintenance window and prioritise it below higher-impact GitLab advisories in the same release train.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-348, Use of Less Trusted Source: during a GitLab Direct Transfer import (the built-in mechanism that migrates groups and projects from another GitLab instance via its API, recreating merge requests, issues and comments along with their attributed authors), the import path relied on transient, ephemeral cache state to resolve author identity instead of an authoritative, validated mapping to users on the target instance. That allowed an authenticated importer to have imported merge request content attributed to arbitrary pre-existing users. The affected component is the Direct Transfer import pipeline in GitLab Community Edition and Enterprise Edition; the provided CPE string cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* is version-wildcarded and therefore does not scope versions on its own, so version ranges must be taken from the vendor advisory. Our independent assessment rates the vector as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N (high attack complexity rather than the vendor's low), reflecting that the flaw manifests only 'under certain conditions' involving a race/timing dependency on cache state, which materially reduces reliable reproducibility; the consequence is a low-integrity, attribution-only defect (spoofed authorship), with no data exposure or denial of service.
Know when Ruby gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable authenticated import feature (PR:L); AC:H because the flaw depends on transient ephemeral-cache state ('certain conditions'); integrity-only I:L for authorship spoofing, C:N/A:N.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated
Exploit-DB