---
id: CVE-2026-100755
title: >-
  GitLab has remediated an issue in GitLab CE/EE affecting all versions from
  16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under
  certain deployment configurations, could have allowed an authenticated user to
  poison c…
summary: >-
  GitLab has remediated an issue in GitLab CE/EE affecting all versions from
  16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under
  certain deployment configurations, could have allowed an authenticated user to
  poison c…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-349
vendor: gitlab
product: gitlab
affected:
  - 'gitlab >= 16.2.0, < 19.2.8'
  - 'gitlab >= 19.3.0, < 19.3.5'
  - 'gitlab >= 19.4.0, < 19.4.2'
patched:
  - gitlab 19.4.2
published: '2026-10-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:17:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100755'
references:
  - url: >-
      https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
    label: cve@gitlab.com
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/work_items/627507'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
epss: 0.00092
epssPercentile: 0.0048
ingestedAt: '2026-10-13T03:13:18.985Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T19:04:26.774513Z'
---

## Overview

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.

## Affected

- `gitlab >= 16.2.0, < 19.2.8`
- `gitlab >= 19.3.0, < 19.3.5`
- `gitlab >= 19.4.0, < 19.4.2`

## Remediation

Upgrade past the affected range:

- `gitlab 19.4.2`