Improper Cache Key Construction in GitLab CE/EE
CVE-2026-100755

4.6MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-100755?

GitLab has identified a security issue in GitLab CE/EE that affects multiple versions. Under specific configurations, an authenticated user could exploit improper cache key construction to manipulate cached page content, potentially leading to content poisoning for other users. It is crucial for users of affected versions to apply updates and patches to mitigate any risk associated with this vulnerability.

Affected Version(s)

GitLab 16.2 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627507
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability has been discovered internally by GitLab team member Peter Arts
.