CVE-2026-4922 - Vulnerability Analysis

Overview

GitLab CE/EE >= 17.0, < 18.9.6, 18.10 < 18.10.4, and 18.11 < 18.11.1 contain a cross site request forgery caused by insufficient CSRF protection in GraphQL mutations, letting unauthenticated users execute mutations on behalf of authenticated users, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated users can perform actions as authenticated users via GraphQL mutations, potentially leading to unauthorized data modification or access.

Mitigation

Update to versions 18.9.6, 18.10.4, 18.11.1 or later.

References

• https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/594937
• https://hackerone.com/reports/3627285

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner