CVE-2026-105711: Use of Cache Containing Sensitive Information in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which users could access the leaked information?
An authenticated user with no membership in the affected projects could read a confidential issue title when a public project's merge request referenced that issue in a private project.
What conditions are required for exploitation?
A merge request in a public project must reference a confidential issue in a private project. The attacker must be authenticated and able to view the public merge request; no membership in either project is required.
What information could be exposed?
The issue affects the confidentiality of the confidential issue's title. The provided information does not indicate exposure of the issue body or other issue data.
Which GitLab versions need remediation?
Affected versions are 15.0 through before 19.3.6, 19.4 through before 19.4.3, and 19.5 through before 19.5.1. Updating to 19.3.6, 19.4.3, 19.5.1, or a later applicable release remediates the issue.