CVE-2026-92530: 
GitLab vulnerability analysis and mitigation

CVE-2026-92530 is a merge request authorship spoofing vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). It affects all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user could spoof merge request authorship and falsely attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, GitLab Patch Release).

The root cause is classified as CWE-348 (Use of Less Trusted Source), where GitLab improperly relies on ephemeral cache state during Direct Transfer import operations rather than a more authoritative and tamper-resistant data source for determining merge request authorship. An authenticated attacker can manipulate this cache state during an import to associate merge request content with an arbitrary existing user on the target instance. The attack is network-based, requires low privileges (an authenticated account), and no user interaction, making it relatively straightforward to attempt under the right import conditions (GitHub Advisory).

Successful exploitation allows an authenticated attacker to falsely attribute merge request authorship to any existing user on the GitLab instance, undermining the integrity of the audit trail and code review history. This could be used to frame other users for malicious or unauthorized code changes, erode trust in the platform's attribution mechanisms, or facilitate social engineering attacks. There is no confidentiality or availability impact; the vulnerability is limited to integrity (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account and specific conditions involving Direct Transfer import operations.

GitLab has released patched versions addressing this vulnerability: 19.2.7, 19.3.3, and 19.4.1. Administrators should upgrade to one of these versions as the primary remediation. If immediate upgrading is not feasible, organizations should limit or disable Direct Transfer import operations and monitor merge request creation events for unexpected authorship changes during import activities (GitLab Patch Release, GitHub Advisory).