CVE-2026-4922: 
GitLab vulnerability analysis and mitigation

CVE-2026-4922 is a Cross-Site Request Forgery (CSRF) vulnerability in the GitLab CE/EE GraphQL API that allows an unauthenticated attacker to execute GraphQL mutations on behalf of authenticated users. It affects all GitLab CE/EE versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1. GitLab.com and GitLab Dedicated instances were patched automatically. The vulnerability was disclosed on April 22, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitLab Advisory, GitHub Advisory).

The root cause is insufficient CSRF protection in GitLab's GraphQL API endpoint, classified as CWE-352 (Cross-Site Request Forgery). Because the GraphQL API does not adequately verify that requests originate from legitimate, user-initiated actions, an attacker can craft a malicious web page or link that, when visited by an authenticated GitLab user, silently submits GraphQL mutation requests using the victim's session credentials. No privileges are required on the attacker's part, but user interaction (i.e., the victim clicking a malicious link or visiting a crafted page while authenticated) is necessary. The vulnerability was reported to GitLab through the HackerOne bug bounty program by researcher 'ahacker1' (GitLab Advisory, GitHub Advisory).

Successful exploitation allows an attacker to perform unauthorized GraphQL mutations on behalf of an authenticated GitLab user, resulting in high confidentiality and integrity impact with no availability impact. This could lead to unauthorized modification of project settings, user permissions, issue management, repository configurations, and other critical GitLab functionality — all without the victim's knowledge or consent. The scope of impact is limited to the affected GitLab instance (unchanged scope), but the breadth of actions possible via GraphQL mutations makes this a significant risk for organizations hosting sensitive code or CI/CD pipelines (GitLab Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.008% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify self-managed GitLab instances running versions 17.0 through 18.9.5, 18.10.0 through 18.10.3, or 18.11.0 using tools like Shodan, Censys, or by inspecting GitLab login pages for version metadata.
2. Craft malicious CSRF payload: Create an HTML page or JavaScript snippet that sends a cross-origin HTTP POST request to the target GitLab instance's GraphQL API endpoint (e.g., /api/graphql) containing a desired GraphQL mutation (e.g., modifying project settings, adding SSH keys, or changing user roles).
3. Deliver the payload: Trick an authenticated GitLab user into visiting the malicious page via phishing email, social engineering, or embedding the payload in a publicly accessible resource.
4. Mutation executes: When the victim's browser loads the page, the forged GraphQL mutation request is sent with the victim's session cookies, bypassing CSRF protections and executing the mutation with the victim's privileges.
5. Achieve objective: Depending on the victim's permissions, the attacker may have modified project configurations, exfiltrated sensitive data accessible via GraphQL queries, escalated privileges, or planted backdoors in repositories (GitLab Advisory, GitHub Advisory).

• Network: Unexpected cross-origin POST requests to /api/graphql from unusual referrer domains or with missing/invalid CSRF tokens in server access logs.
• Logs: GitLab application logs showing GraphQL mutation activity (e.g., project setting changes, permission modifications, SSH key additions) at unusual times or from IP addresses inconsistent with the authenticated user's normal behavior.
• Application Events: Audit log entries in GitLab recording unexpected changes to project membership, group settings, CI/CD variables, or deploy keys that the user did not initiate.
• User Reports: Authenticated users reporting unexpected changes to their projects or account settings without having performed those actions themselves.

GitLab has released patched versions addressing this vulnerability: upgrade to 18.9.6 (for versions 17.0–18.9.x), 18.10.4 (for versions 18.10.x), or 18.11.1 (for versions 18.11.x). GitLab.com and GitLab Dedicated customers are already protected and do not need to take action. As a defense-in-depth measure, administrators should consider implementing Content Security Policy (CSP) headers and educating users about the risks of visiting untrusted websites while authenticated to GitLab (GitLab Advisory).

The vulnerability received coverage from several security news outlets including SecurityOnline, GBHackers, CyberPress, and Cybernoz, which highlighted it as part of a broader GitLab April 2026 security update addressing multiple high-severity issues. The Belgian Centre for Cybersecurity (CCB) issued an advisory urging immediate patching of GitLab CE/EE instances. The vulnerability was also noted in weekly threat landscape digests. Community reaction was generally focused on the breadth of the April 2026 patch release rather than this specific CVE in isolation (SecurityOnline, CCB Advisory).