A vulnerability in GitLab CE/EE versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 could allow an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users due to improper reliance on ephemeral cache state during Direct Transfer imports. This issue has been remediated by GitLab.