GitLab EUVD-2026-85735

Requires an authenticated user (PR:L) with the ability to perform a GitLab Direct Transfer import (group/project migration by direct transfer must be enabled and available to the attacker). The flaw is triggered only 'under certain conditions' involving improper reliance on ephemeral cache state during the import, indicating a timing/state dependency rather than a deterministic path - this materially limits reliable exploitation. Impact is limited to spoofing merge-request authorship/attribution to existing users on the same target instance; no confidentiality or availability effect. Affected only on GitLab CE/EE 19.1-19.2.6, 19.3-19.3.2, and 19.4.0.

This is a genuinely low-priority finding despite being a valid, vendor-confirmed vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) reflects an integrity-only impact: an authenticated user can forge merge-request authorship, but there is no confidentiality or availability impact and no scope change. No EPSS score, no CISA KEV listing, and no public POC are present in the input, and no SSVC decision data is provided - meaning there is no signal of active or automatable exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The one point of tension is the vendor's AC:L: the description explicitly says the flaw only manifests 'under certain conditions' via 'improper reliance on ephemeral cache state,' which points to a timing/race dependency more consistent with AC:H - verify the exact trigger with GitLab work-item 628379. Net: a real, correctly-attributed integrity/spoofing issue worth patching in routine cycles, but not an urgent, widely-weaponizable priority.

An authenticated user with import privileges initiates a GitLab Direct Transfer (group/project) import and, by exploiting stale ephemeral cache state during the import, causes merge requests and their content to be attributed to an arbitrary existing user on the target instance - enabling social-engineering or repudiation attacks where malicious changes appear authored by a trusted colleague. No public exploit code is identified, and the 'certain conditions' wording suggests reliable triggering requires specific import timing/state.