Vulnerability · Published Aug 17, 2026 · Assigned by GitLab
CVE-2026-19650Cross-Site Request Forgery (CSRF) in GitLab
High 7.1
In plain English
A high-severity cross-site request forgery in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/612617
- HackerOne Bug Bounty Report #3903669 technical-description, exploit, permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/