{"id":"CVE-2026-105711","kind":"vulnerability","aliases":["CVE-2026-105711"],"related":[],"title":"GitLab CE/EE: cached merge request previews leaked confidential issue titles","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.","summary":"GitLab's rendered-content cache reused a redacted view of a merge request reference across users, so an authenticated user with no project membership could read the title of a confidential issue in a private project. An attacker gets only the issue title, not its body or other data.","severity":"low","cvss":3.5,"epss":0.00212,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","gitlab-ce","gitlab-ee","infrastructure","self-hosted"],"not_affected_if":["all-projects-private","gitlab-com-managed"],"how_to_check":"- Check the installed GitLab version with `gitlab-rake gitlab:env:info` or the version shown under the Admin Area.\n- Confirm whether the instance is GitLab CE or EE and whether it runs on a version from 15.0 through the fixed releases listed below.","fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the release line you run.\n- Upgrade to any later patch release on the same line.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:45:40+00:00","updated_at":"2026-10-25T04:45:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the release line you run.\n- Upgrade to any later patch release on the same line.","reach":"internet","title":"GitLab CE/EE: cached merge request previews leaked confidential issue titles","impact":"low","summary":"GitLab's rendered-content cache reused a redacted view of a merge request reference across users, so an authenticated user with no project membership could read the title of a confidential issue in a private project. An attacker gets only the issue title, not its body or other data.","category":"infrastructure","nicknames":[],"who_cares":["gitlab","self-hosted","gitlab-ce","gitlab-ee"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated outsiders read titles of confidential issues in private projects","analyst_note":"","how_to_check":"- Check the installed GitLab version with `gitlab-rake gitlab:env:info` or the version shown under the Admin Area.\n- Confirm whether the instance is GitLab CE or EE and whether it runs on a version from 15.0 through the fixed releases listed below.","needs_analyst":false,"not_affected_if":["all-projects-private","gitlab-com-managed"],"who_is_affected":"Self-managed GitLab CE or EE instances running versions from 15.0 up to the fixed releases, where public projects exist alongside private projects with confidential issues. Instances where all projects are private, or GitLab.com managed by the vendor, are not exposed in the same way; the sources do not say whether GitLab.com was patched on its own schedule.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":3428,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-105711':13A,16A '-2026':12A,15A '15.0':90C '19.3.6':92C '19.4':93C '19.4.3':95C '19.5':97C '19.5.1':99C 'across':43B,150C 'affect':86C 'attack':66B 'authent':47B,118C 'bodi':74B 'cach':3A,33B,139C 'ce':20B 'ce/ee':2A,85C 'confidenti':8A,59B,111C,128C 'content':32B,149C 'could':53B,124C 'cve':11A,14A 'data':77B 'due':132C 'ee':23B 'fragment':138C 'get':67B 'gitlab':1A,17B,19B,22B,28B,78C,84C 'gitlab-c':18B 'gitlab-e':21B 'host':27B 'incorrect':142C 'independ':137C 'infrastructur':24B 'issu':9A,60B,70B,82C,112C,129C 'key':140C 'leak':7A 'membership':52B,123C 'merg':4A,40B,103C 'per':145C 'per-user-redact':144C 'preview':6A 'privat':63B,115C 'project':51B,64B,108C,116C,122C 'public':107C 'read':54B,126C 'redact':36B,147C 'refer':42B 'referenc':109C 'remedi':80C 'render':31B,148C 'rendered-cont':30B 'request':5A,41B,104C 'reus':34B 'self':26B 'self-host':25B 'share':143C 'titl':10A,56B,71B,131C 'user':44B,48B,119C,146C,152C 'version':88C 'view':37B 'viewer':136C 'viewer-independ':135C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab CE or EE instances running versions from 15.0 up to the fixed releases, where public projects exist alongside private projects with confidential issues. Instances where all projects are private, or GitLab.com managed by the vendor, are not exposed in the same way; the sources do not say whether GitLab.com was patched on its own schedule.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105711","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105711","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105711","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}