Notes from one issue displayed in activity feed of different issue

Summary

Notes from one issue are being rendered in the activity feed of a completely different issue. The database and API both confirm that the notes belong to the correct issue, but the frontend displays them under the wrong issue.

Steps to reproduce

We're running into this bug on a specific customer instance but I'm not able to reproduce it on ,y instance.

What is the current bug behavior?

Notes from one issue (with noteable_id: 441) are being displayed in the activity feed of a different issue (with id: 224018). The note was created in 2016, but the issue it's appearing on was created in December 2025. Viewing in incognito mode yields same results.

What is the expected correct behavior?

Only notes with noteable_id matching the current issue's id should appear in the activity feed.

Relevant logs and/or screenshots

DB query to find the parent issue:

SELECT n.id, n.noteable_type, n.noteable_id, n.created_at, u.username, LEFT(n.note, 80) as note_preview 
FROM notes n 
JOIN users u ON n.author_id = u.id 
WHERE n.id = 3827;

 id  | noteable_type | noteable_id |         created_at         | username |                                   note_preview                                   
------+---------------+-------------+----------------------------+----------+----------------------------------------------------------------------------------
3827 | Issue         |         441 | 2016-01-08 10:46:01.663819 | manoj    | @suhas @anshuman This is a developer specific item. @vinay will do the testing. 
(1 row)

The API endpoint for the issue also returns only notes with the matching noteable_id. Note 3827 does NOT appear in the API response. See more details here(Internal Link)

Wrongly displayed note in a 2025 issue:

The original note in 2016 issue:

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info

gitlab-ee 18.5.3

## Component Installed Version Version GUID

alertmanager v0.28.1 git:b2099eaa2c9ebc25edb26517cb9c732738e93910\
bzip2 1.0.8 sha512:083f5e675d73f3233c7930ebe20425a533feedeaaa9d8cc86831312a6581cefbe6ed0d08d2fa89be81082f2a5abdabca8b3c080bf97218a1bd59dc118a30b9f3\
cacerts 2022.07.19 sha256:6ed95025fba2aef0ce7b647607225745624497f876d74ef6ec22b26e73e9de77\
chef-acme v4.1.6 git:c670bfbcdd7957fa052872c23e38dfba7eef02dc\
chef-gem 18.3.0\
compat_resource v12.19.1 git:e36200f6b804915b68a4ce74c8b7a293c041d9fe\
config_guess c9092d05347c925a26f6887980e185206e13f9d6 git:00b15927496058d23e6258a28d8996f87cf1f191\
consul v1.21.4 git:59b8b905d5abc3f955b81d76c138bf5eab2ca01a\
cosign v2.5.3 git:488ef8ceed5ab5d77379e9077a124a0d0df41d06\
curl curl-8_15_0 git:cfbfb65047e85e6b08af65fe9cdbcf68e9ad496a\
exiftool 12.99 git:4981552ec9bf94a0b5a64a06919b5e4f797c208e\
fast-stats v0.8.5 git:05463ec2553f1719ae023766ffb8764c86e47fe1\
git v18.5.3 git:cfb260eda76a65500e3034fb95ef71e8528c2292\
git-filter-repo v2.47.0\
gitaly v18.5.3 git:cfb260eda76a65500e3034fb95ef71e8528c2292\
gitlab-backup-cli 11bd2a07e00a1c1de5d6a7dfe4301fe4\
gitlab-config-template 18.5.3\
gitlab-cookbooks 18.5.3\
gitlab-ctl 18.5.3\
gitlab-ctl-ee 18.5.3\
gitlab-elasticsearch-indexer v5.9.4 git:aff4eb4cddbff0f2c8cef1c56bb44a561152ab6c\
gitlab-exporter 15.6.0\
gitlab-geo-psql 829ff725af11406efef31cfe6255afcb\
gitlab-healthcheck 0060154a010637bec197fb38217ddcbc\
gitlab-kas v18.5.3 git:fb99107f80c3eadf5a2f60d3d3c8de8df4e9e500\
gitlab-pages v18.5.3 git:0be99b5fe1843491ae265a438efb4490ae788fd7\
gitlab-pg-ctl 708eef37ad59a61728d790c485aae4a6\
gitlab-psql 4ac3cc368e73f3750591493104798fce\
gitlab-rails v18.5.3-ee git:37d9b316e5414077656f5fc6ac4483424b41b811\
gitlab-redis-cli e16c5ba796580cf0c774589f65392f65\
gitlab-scripts 18.5.3\
gitlab-shell v14.45.3 git:f5da5793dc9b9d720626f3f59a61a6331d236305\
gitlabsos ccb1edb6aafe88e1ba612643c015f41471bbab88 git:ccb1edb6aafe88e1ba612643c015f41471bbab88\
gnupg 2.2.41 sha256:13f3291007a5e8546fcb7bc0c6610ce44aaa9b3995059d4f8145ba09fd5be3e1\
go-crond 23.12.0 git:4f2e74e2a5544a72c6523c22f687d72be593e981\
gpgme 1.18.0 sha256:361d4eae47ce925dba0ea569af40e7b52c645c4ae2e65e5621bf1b6cdd8b0e9e\
graphicsmagick 1.3.45 sha256:dcea5167414f7c805557de2d7a47a9b3147bcbf617b91f5f0f4afe5e6543026b\
inspec-gem 6.6.0\
jemalloc 5.3.0 git:1972241cd204c60fb5b66f23c48a117879636161\
krb5 krb5-1.22.1-final git:4272fb71b130e50185a7711769a6296a4e562a5d\
libarchive 3.8.1 sha256:bde832a5e3344dc723cfe9cc37f8e54bde04565bfe6f136bc1bd31ab352e9fab\
libassuan 2.5.5 sha256:8e8c2fcc982f9ca67dcbb1d95e2dc746b1739a4668bc20b3a3c5be632edb34e4\
libedit 20120601-3.0 sha256:51f0f4b4a97b7ebab26e7b5c2564c47628cdb3042fd8ba8d0605c719d2541918\
libevent release-2.1.12-stable git:5df3037d10556bfcb675bc73e516978b75fc7bc7\
libffi 3.2.1 sha256:d06ebb8e1d9a22d19e38d63fdb83954253f39bedc5d46232a05645685722ca37\
libgcrypt 1.9.4 sha256:ea849c83a72454e3ed4267697e8ca03390aee972ab421e7df69dfe42b65caaf7\
libgpg-error 1.46 sha256:b7e11a64246bbe5ef37748de43b245abd72cfcd53c9ae5e7fc5ca59f1c81268d\
libiconv 1.15 sha256:ccf536620a45458d26ba83887a983b96827001e92a13847b45e4925cc8913178\
libicu release-63-1 git:227c729b0e9e1d4e15993741a8854180a42f998a\
libjpeg-turbo 2.1.5.1 git:8ecba3647edb6dd940463fedf38ca33a8e2a73d1\
libksba 1.6.3 sha256:3f72c68db30971ebbf14367527719423f0a4d5f8103fc9f4a1c01a9fa440de5c\
liblzma 5.2.4 sha256:b512f3b726d3b37b6dc4c8570e137b9311e7552e8ccbab4d39d47ce5f4177145\
libossp-uuid 1.6.2 sha256:11a615225baa5f8bb686824423f50e4427acd3f70d394765bdff32801f0fd5b0\
libpng v1.6.50 git:2b978915d82377df13fcbb1fb56660195ded868a\
libtensorflow_lite v2.6.0 git:96cd1956e607ca2b256ac01444caf3a9c61396fa\
libtiff v4.7.0 git:9dff73bebc5661f2dace6f16e14cf9e857172f4e\
libtool 2.4.6 sha256:e3bd4d5d3d025a36c21dd6af7ea818a2afcd4dfc1ea5a17b39d7854bcd0c06e3\
libxml2 2.14.5 sha256:03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b\
libxslt 1.1.43 sha256:5a3d6b383ca5afc235b171118e90f5ff6aa27e9fea3303065231a6d403f0183a\
libyaml 0.2.5 sha256:c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4\
logrotate 3.22.0 git:41efb71b765b08e53e2c411e0a2897d30f44eefc\
mattermost 10.10.2 sha256:57d58210339189349d2d67ab684a2c34aabfeed563983060598aa9f4af1b426e\
ncurses 6315e1a380ecdb706d4f6518d2e8c7eb0db8fbe2 git:87c2c84cbd2332d6d94b12a1dcaf12ad1a51a938\
nginx release-1.29.0 git:235f409907fd60eb2d8f6ecdc0e5cb163dd6d45f\
nginx-module-vts v0.2.4 git:bdb2699d87a84ed593de3ca114290740b530a514\
ngx_security_headers 0.0.9 git:5f34cd8395614caf7650a592c89589a2ced4db02\
node-exporter v1.9.1 git:f2ec547b49af53815038a50265aa2adcd1275959\
npth 1.6 sha256:1393abd9adcf0762d34798dc34fdcf4d0d22a8410721e76f1e3afcd1daa4e2d1\
omnibus-ctl v0.6.12 git:0307d88c60c0b08fd1943acef223d9aa425c8e93\
omnibus-gitlab-gems 20250418 path:/builds/gitlab/omnibus-gitlab/config/templates/omnibus-gitlab-gems\
openssl openssl-3.4.1 git:2466b57b893503f602622ad4f7cba1f3a2585ec0\
package-scripts 18.5.3+ee.0\
patroni 3.0.1\
pcre2 pcre2-10.45 git:d213fba6c8ecf7b469ea32368205be09c8e0073f\
pgbouncer pgbouncer_1_24_1 git:2305be8887b902c46bec7acdbf644e039061195c\
pgbouncer-exporter v0.11.0 git:766ca7ef118144cfe872c096af7c638ac3c769d6\
pkg-config-lite 0.28-1 sha256:21b76ec4e115ee30f9b3077a2506e48e8b837332ed4d30c9776502e69c6a29e5\
popt 1.16 sha256:e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8\
postgres-exporter v0.15.0 git:68c176b8833b7580bf847cecf60f8e0ad5923f9a\
postgresql 16.10 sha256:de8485f4ce9c32e3ddfeef0b7c261eed1cecb54c9bcd170e437ff454cb292b42\
prometheus v2.55.1 git:6d7569113f1ca814f1e149f74176656540043b8d\
psycopg2 2.9.10 git:a805acf59f402f554e95624b5e27518169ca7715\
python-docutils 0.19\
python3 3.9.24 sha256:9a32cfc683aecaadbd9ed891ac2af9451ff37f48a00a2d8e1f4ecd9c2a1ffdcb\
rb-readline master git:9fba246073f78831b7c7129c76cc07d8476a8892\
redis 7.2.11 git:05827336b0efcb454bcc5fe77ceacc6f226b6bb2\
redis-exporter v1.74.0 git:009602959fd20c5a78de639490745c8bbc7b2e06\
registry v4.28.0-gitlab git:f2bab3aea08084bdb742e8882d98fbf9b2cd1c22\
rsync 3.4.1 sha256:2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52\
ruby 3.2.8 sha256:77acdd8cfbbe1f8e573b5e6536e03c5103df989dc05fa68c70f011833c356075\
rubygems 3.7.1\
runit 2.1.2 sha256:6fd0160cb0cf1207de4e66754b6d39750cff14bb0aa66ab49490992c0c47ba18\
spam-classifier 0.3.0 sha256:c9f7e147d195a45e32c35765e138e006e7636218f8c4413e67d0cef5513335a8\
spamcheck v0.3.2 git:e1d8002ff4fbff2f5b0c8baa6d381607a2863f7f\
unzip 6.0.29 sha256:036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37\
version-manifest 0.0.1\
zlib-ng 2.2.4 git:fe179585e7c25234c2c224116ccfed8b0a78dbd9