{"id":"CVE-2026-105711","aliases":[],"cve":{"records":[{"id":"CVE-2026-105711","source":"GitLab","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-05T18:35:06.853Z","published":"2026-10-21T23:34:30.427Z","modified":"2026-10-30T17:18:23.616Z"}],"publishers":[{"name":"GitLab","role":"CNA","organizationId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","modified":"2026-10-21T23:34:30.427Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:23.616Z"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/632207","tags":[],"source":"GitLab"},{"url":"https://hackerone.com/reports/3963293","tags":["technical-description","exploit","permissions-required"],"source":"GitLab"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","tags":[],"source":"GitLab"}],"weaknesses":[{"id":"CWE-524","description":"CWE-524: Use of Cache Containing Sensitive Information","source":"GitLab"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:38:36.737514Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Use of Cache Containing Sensitive Information in GitLab","titleSource":"GitLab","descriptionSource":"GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.","score":3.5,"severity":"low","published":"2026-10-21T23:34:30.427Z","modified":"2026-10-30T17:18:23.616Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"GitLab","name":"GitLab","platforms":[],"versions":[{"version":"15.0","status":"affected","lessThan":"19.3.6","versionType":"semver"},{"version":"19.4","status":"affected","lessThan":"19.4.3","versionType":"semver"},{"version":"19.5","status":"affected","lessThan":"19.5.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"source":"GitLab","url":"https://www.cve.org/CVERecord?id=CVE-2026-105711"}],"remediation":[{"text":"Upgrade to versions 19.3.6, 19.4.3, 19.5.1 or above.","source":"GitLab","url":"https://www.cve.org/CVERecord?id=CVE-2026-105711"}],"references":["https://gitlab.com/gitlab-org/gitlab/-/work_items/632207","https://hackerone.com/reports/3963293","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"],"sources":[{"name":"CVE","id":"CVE-2026-105711","modified":"2026-10-30T17:18:23.616Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-105711"}],"assessments":[{"source":"GitLab","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","score":3.5}],"sourceAffected":[],"observedAt":"2026-10-30T19:25:55.081Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:05:32.009Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"GitLab CE/EE versions 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 have a weakness where an authenticated user with no project membership could read a confidential issue's title due to a cache containing sensitive information. The issue occurs when a merge request in a public project references a confidential issue from a private project. An authenticated user can access the sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T12:51:12.602Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-105711"}]}}