CVE-2026-92530: gitlab — Fix

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

Is your site exposed to CVE-2026-92530?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0011

Probability of exploitation

0.01%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-348 CWE-348

Affected Products

Vendor	Product	Versions
gitlab	gitlab	19.1.0 — 19.2.7
gitlab	gitlab	19.1.0 — 19.2.7
gitlab	gitlab	19.3.0 — 19.3.3
gitlab	gitlab	19.3.0 — 19.3.3
gitlab	gitlab	All
gitlab	gitlab	All

References

Advisories & Patches

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/

Other References

https://gitlab.com/gitlab-org/gitlab/-/work_items/628379

Frequently Asked Questions

What is CVE-2026-92530? +

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2026-92530? +

CVE-2026-92530 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0011, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-92530? +

CVE-2026-92530 affects products from gitlab, specifically: gitlab. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-92530? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, …

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() …

CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior …

CVE-2026-121619

The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method trust remote clients as reverse proxies when the private_ranges shortcut …

CVE-2026-93483

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions …

CVE-2026-9561

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP …