GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issues title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.
Weakness
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 15.0.0 (including) | 19.3.6 (excluding) |
| Gitlab | Gitlab | 19.4.0 (including) | 19.4.3 (excluding) |
| Gitlab | Gitlab | 19.5.0 (including) | 19.5.0 (including) |