GitLab CE/EE EUVD-2026-107674

Exploitation requires a specific data arrangement: a merge request inside a public GitLab project must reference a confidential issue that lives in a private project, and the shared fragment cache must hold the redacted rendered content. The attacker must be an authenticated GitLab user (PR:L) but needs no membership in the private project. Limiting factors: only the confidential issue's title is disclosed (not body or comments), the cross-project public-MR-to-private-confidential-issue reference must actually exist, and the viewer-independent cache entry must be populated - so this is opportunistic disclosure, not reliable targeted extraction of arbitrary private data.

This is a low-severity information disclosure (CVSS 3.5, CWE-524) and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable but authenticated issue with limited confidentiality impact only - no integrity or availability effect, and no scope change. Publicly available exploit code exists (a HackerOne report), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The leak is narrow: only the title of a confidential issue is exposed, and only under a specific cross-project reference condition. Net assessment: this is a genuine but low-priority confidentiality bug - patch it in normal maintenance cycles rather than as an emergency. Note the mismatch between a public POC and the absence of KEV/EPSS data: exploit code being published does not imply it is being used at scale, and the limited impact (one issue title) makes mass exploitation unlikely.

An authenticated GitLab user with no membership in a private project browses a public project whose merge request references a confidential issue in that private project. Because a viewer-independent fragment cache key shared per-user-redacted rendered content across all users, the attacker reads the confidential issue's title that should have been redacted for them. A public proof-of-concept exists on HackerOne, and exploitation requires only normal authenticated browsing of the affected merge request.