GitLab has a defect that lets an authenticated user forge the author of a merge request when using Direct Transfer imports. The flaw stems from an improper use of volatile cache state, letting the user attribute added content to any existing user on the instance. This can mislead contributors, hide malicious changes, or damage trust within the project. The weakness falls under CWE-348, which describes the use of less trusted sources for data.

GitLab Community and Enterprise Editions are affected from version 19.1 up to, but not including, 19.2.7, from 19.3 up to, but not including, 19.3.3, and from 19.4 up to, but not including, 19.4.1. Any installation running one of these versions is at risk of the spoofing vulnerability.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. Because the flaw requires an authenticated user who can perform Direct Transfer imports, the attack vector is likely an internal user with import privileges. The risk is primarily reputational and integrity‑related, as it allows an attacker to make code appear authored by trusted users but does not grant remote code execution or system compromise.