Information Disclosure in GitLab CE/EE Public Projects
CVE-2026-105711

3.5LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105711?

This vulnerability in GitLab CE/EE allows unauthorized users to access titles of confidential issues when a merge request from a public project references them. The flaw arises from the improper implementation of viewer-independent fragment cache keys leading to content being incorrectly shared among all users, potentially exposing sensitive information.

Affected Version(s)

GitLab 15.0 < 19.3.6

GitLab 19.4 < 19.4.3

GitLab 19.5 < 19.5.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/632207
https://hackerone.com/reports/3963293
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [20kilograma](https://hackerone.com/20kilograma) for reporting this vulnerability through our HackerOne bug bounty program
.