GitLab CE/EE CVE-2026-19650

Exploitation requires that the targeted GitLab instance is network-reachable by the attacker (or the attacker can serve a page the victim's browser will load while the victim has an active, authenticated GitLab session). The core condition enabling this vulnerability is that GitLab's GraphQL multiplex query endpoint accepts mutation operations delivered via HTTP GET requests - a non-default behavior in compliant GraphQL implementations. The victim must be authenticated to the GitLab instance and must interact with attacker-controlled content (visit a page, load a resource) that causes their browser to issue the crafted GET request. Exploitation is limited by the UI:R requirement: fully automated, zero-interaction exploitation is not possible. Additionally, the attacker does not need a GitLab account of their own. Publicly exposed GitLab instances (internet-facing) face higher risk than instances restricted to internal networks, since delivering the malicious page to a victim is easier in external scenarios.

The CVSS 7.1 High score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L accurately characterizes the threat: network-reachable, low complexity, no attacker privileges needed, but requiring one victim interaction (UI:R). The high integrity impact reflects the ability to execute arbitrary GraphQL mutations - repository modifications, project deletions, user changes, or CI/CD pipeline manipulation - without any authentication on the attacker's part. The UI:R constraint is a meaningful limiter, requiring social engineering or a watering-hole attack, and it prevents fully automated exploitation. That said, the publicly available exploit code (HackerOne report #3903669) significantly narrows the skill threshold, and even a mid-sized municipal IT team in inowroclaw running a self-hosted GitLab instance should treat this as urgent given the low technical bar now that a POC is public. No KEV listing is confirmed at time of analysis, so exploitation is not yet confirmed as widespread; however, POC availability historically accelerates opportunistic targeting of GitLab instances exposed to the internet. The absence of any confidentiality impact (C:N) is consistent with CSRF semantics - the attacker acts as a proxy through the victim's session and does not directly extract data.

An attacker identifies a GitLab administrator or developer authenticated to a self-hosted GitLab instance and sends them a phishing link or embeds a malicious image tag in a webpage pointing to a crafted GET URL against the GitLab GraphQL multiplex endpoint containing a mutation payload. When the victim's browser follows the link while their GitLab session is active, the mutation executes in their security context - potentially deleting repositories, adding attacker-controlled SSH keys, modifying CI/CD pipeline configurations, or changing access permissions. A publicly available exploit report on HackerOne (https://hackerone.com/reports/3903669) demonstrates the technique.