cyfenced.com →

[ CVE-2026-105711 · Published 22 Oct 2026 ]

Vulnerability in GitLab

CVSS 3.5 EPSS <1%3 agency advisoriesNo fix listed yet

[ Description ]Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0447

    Vulnerabilities fixed in GitLab by GitLab Inc. Translated from Dutch

    Probability/damage M/HCVE-2026-12664CVE-2026-13319CVE-2026-14288+9 more CVEs
  • CERT-FRCERTFR-2026-AVI-1363

    Multiple vulnerabilities in GitLab Translated from French

    Multiple vulnerabilities have been discovered in GitLab. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and a security policy bypass.

    CVE-2026-12664CVE-2026-112378CVE-2026-15723+9 more CVEs
  • BSI CERT-BundWID-SEC-2026-4115

    GitLab: Multiple vulnerabilities Translated from German

    Risk highCVE-2026-13319CVE-2026-110264CVE-2026-112378+9 more CVEs

[ References ]References