Live › vulnerability › CVE-2026-105711
Go to dashboardGitLab's rendered-content cache reused a redacted view of a merge request reference across users, so an authenticated user with no project membership could read the title of a confidential issue in a private project. An attacker gets only the issue title, not its body or other data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-managed GitLab CE or EE instances running versions from 15.0 up to the fixed releases, where public projects exist alongside private projects with confidential issues. Instances where all projects are private, or GitLab.com managed by the vendor, are not exposed in the same way; the sources do not say whether GitLab.com was patched on its own schedule.
No product ranges from the sources yet.
gitlab-rake gitlab:env:info or the version shown under the Admin Area.19.3.6, 19.4.3, or 19.5.1 depending on the release line you run.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.
This page as .md · .json · in your agent: get_signal("CVE-2026-105711")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.