CVE-2026-92530: GitLab Auth Bypass Vulnerability

CVE-2026-92530 Overview

CVE-2026-92530 is a merge request authorship spoofing vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. An authenticated user can attribute merge request content to arbitrary existing users on the target instance through Direct Transfer imports. The root cause is improper reliance on ephemeral cache state during the import process, classified as [CWE-348] Use of Less Trusted Source.

Critical Impact
Authenticated attackers can forge merge request authorship, enabling identity spoofing, repudiation attacks, and social engineering within trusted GitLab projects.

Affected Products

GitLab CE/EE versions 19.1 through 19.2.6
GitLab CE/EE versions 19.3 through 19.3.2
GitLab CE/EE version 19.4.0

Discovery Timeline

2026-09-24 - CVE-2026-92530 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-92530

Vulnerability Analysis

The vulnerability resides in GitLab's Direct Transfer import mechanism, which migrates projects and groups between GitLab instances. During import, the system processes merge request metadata including author attribution. The code path relies on ephemeral cache state to resolve user identity rather than validating the authenticated requester against the asserted author.

This trust boundary failure allows an authenticated user to influence which existing user the imported merge request is attributed to. The resulting merge request appears legitimately authored by a different user on the target instance. Observers, including reviewers and audit logs, see the spoofed author rather than the actual importer.

The integrity impact is limited to attribution metadata rather than code execution or data disclosure. However, authorship spoofing undermines code review trust models and git audit trails that organizations rely on for compliance.

Root Cause

The root cause is improper reliance on an ephemeral cache during Direct Transfer imports [CWE-348]. The import logic treats cached identity data as authoritative without re-validating the mapping against the requester's permissions or verified identity claims. Cache poisoning or race conditions in the import workflow can therefore substitute an attacker-chosen user as the recorded author.

Attack Vector

Exploitation requires authenticated access to a GitLab instance with Direct Transfer import permissions. The attacker initiates a Direct Transfer import under specific conditions that cause the cache lookup to return attacker-influenced user mappings. The imported merge request is then recorded with the spoofed author identity.

The attack vector is network-reachable and requires low privileges. No user interaction from the spoofed victim is required. Refer to the GitLab Work Item #628379 for additional technical context.

Detection Methods for CVE-2026-92530

Indicators of Compromise

Merge requests created via Direct Transfer imports where the recorded author did not perform the import action
Audit log entries showing import jobs executed by one user but producing merge requests attributed to a different user
Unexpected merge requests appearing in projects after a Direct Transfer import operation
Discrepancies between author_id on merge requests and the user_id recorded in import audit events

Detection Strategies

Correlate GitLab audit events for project_import_started and group_import_started with the authorship of resulting merge requests
Query the GitLab database or API for merge requests created during import windows and compare author.username to the importer identity
Alert on Direct Transfer imports initiated by low-privilege accounts that generate merge requests attributed to administrators or senior engineers

Monitoring Recommendations

Enable GitLab audit event streaming to a centralized security data lake for import operation visibility
Monitor the /api/v4/projects/:id/import and bulk import endpoints for anomalous usage patterns
Track per-user Direct Transfer import frequency and flag deviations from established baselines

How to Mitigate CVE-2026-92530

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.2.7, 19.3.3, or 19.4.1 as applicable to the deployed branch
Audit all merge requests created through Direct Transfer imports since September 2026 for authorship anomalies
Review and restrict the set of users holding Direct Transfer import permissions to those with a documented business need

Patch Information

GitLab released fixed versions 19.2.7, 19.3.3, and 19.4.1 addressing CVE-2026-92530. Deployment details are documented in the GitLab Patch Release 19.4.1 advisory. Self-managed instances should apply the patch during the next maintenance window. GitLab.com is already running the remediated version.

Workarounds

Disable the Direct Transfer import feature at the instance level until the patch is applied
Restrict import source URLs via the GitLab Admin Area allowlist to trusted instances only
Require administrator approval for all project and group imports as an interim compensating control

bash

# Verify installed GitLab version
sudo gitlab-rake gitlab:env:info | grep -i version

# Disable Direct Transfer imports in gitlab.rb
sudo editor /etc/gitlab/gitlab.rb
# Set: gitlab_rails['bulk_import_enabled'] = false

# Apply configuration and reconfigure
sudo gitlab-ctl reconfigure