PT-2026-34523 · Gitlab · Gitlab Ce/Ee

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4922

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.0 through 18.9.5 GitLab CE/EE versions 18.10 through 18.10.3 GitLab CE/EE versions 18.11 through 18.11.0

Description Insufficient CSRF (Cross-Site Request Forgery) protection could allow an unauthenticated user to execute GraphQL mutations on behalf of authenticated users. CSRF is a type of attack that tricks a victim into performing actions they did not intend to do on a web application where they are currently authenticated.

Recommendations Update versions 17.0 through 18.9.5 to 18.9.6 Update versions 18.10 through 18.10.3 to 18.10.4 Update versions 18.11 through 18.11.0 to 18.11.1

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4922

Affected Products

Gitlab Ce/Ee

References · 5

• 🔥 https://hackerone.com/reports/3627285 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4922 · Security Note
• https://twitter.com/CVEnew/status/2047012070051459209 · Twitter Post
• https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/594937 · Note