Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-92530

Опубликовано: 24 сент. 2026
Источник: nvd
CVSS3: 4.3
EPSS Низкий

Описание

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Версия от 19.1.0 (включая) до 19.2.7 (исключая)
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Версия от 19.1.0 (включая) до 19.2.7 (исключая)
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Версия от 19.3.0 (включая) до 19.3.3 (исключая)
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Версия от 19.3.0 (включая) до 19.3.3 (исключая)
cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 1%
0.00109
Низкий

4.3 Medium

CVSS3

Дефекты

CWE-348

Связанные уязвимости

github логотип

GHSA-wr3r-jhmc-f6jw

CVSS3: 4.3
github
около 2 месяцев назад

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

EPSS

Процентиль: 1%
0.00109
Низкий

4.3 Medium

CVSS3

Дефекты

CWE-348