Home / Vulnerability Intelligence / CVE-2026-3857

CVE-2026-3857 - Vulnerability Analysis

HighCVSS: 8.1

Last Updated: March 25, 2026

Published: March 25, 2026Updated: March 25, 2026Remote Exploitable

Overview

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

Severity & Score

Severity: High

CVSS Score: 8.1

References

https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/592828
https://hackerone.com/reports/3584382

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-3857
Severity: High
CVSS Score: 8.1
Status: new

CWE

CWE-352

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N