Executive brief
GitLab Community and Enterprise Edition are vulnerable to a cross-site request forgery (CSRF) flaw in their GraphQL query handler. An unauthenticated attacker could craft a malicious web page to trick a logged-in GitLab user into executing mutations (data-modifying actions) via simple GET requests, bypassing normal protections. This could allow unauthorized changes to projects, user accounts, and other critical data.
Technical details
The vulnerability is a CSRF issue in GitLab's GraphQL multiplex query handler that fails to properly validate incoming requests. It allows unauthenticated attackers to execute GraphQL mutations via GET requests, which should normally require POST with CSRF tokens. The flaw requires user interaction (the user must visit a malicious page while logged into GitLab) but no authentication. By crafting requests that bypass standard request validation, an attacker can modify or delete projects, accounts, and associated data. Patches are available in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4, and affected GitLab.com and Dedicated instances have already been patched.
Affected products
- GitLab GitLab Community Edition 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, 19.2 before 19.2.4
- GitLab GitLab Enterprise Edition 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, 19.2 before 19.2.4
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Patches released in versions 18.11.11, 19.0.8, 19.1.6, 19.2.4