CVEvulnerability
CVE-2026-4922
8.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-352
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.
Affected configurations
• gitlab gitlab (>= 17.0.0 < 18.9.6)
• gitlab gitlab (>= 18.10.0 < 18.10.4)
• gitlab gitlab 18.11.0
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/594937 Broken Link
- https://hackerone.com/reports/3627285 Permissions Required