What is the CVSS score of CVE-2026-4527?

CVE-2026-4527 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4527?

Yes, a patch is available for CVE-2026-4527. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-4527

EUVD-2026-30230 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-14 cve@gitlab.com

GHSA-rw3w-8j7h-fwr2

CSRF Atlassian Gitlab

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:19 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

AnalysisAI

Cross-Site Request Forgery in GitLab CE/EE allows an unauthenticated attacker to create unauthorized Jira subscriptions within a targeted authenticated user's namespace by tricking the victim into clicking a specially crafted link. All GitLab installations from version 11.10 through the pre-patch 18.x releases are affected across both Community and Enterprise editions. No public exploit exists and this is not listed in CISA KEV; however, the broad version range spanning over seven years of releases and the prevalence of Jira integrations in enterprise GitLab deployments make patching a meaningful priority.

Technical ContextAI

GitLab's Atlassian Jira integration permits users to subscribe project namespaces to Jira event notifications. The vulnerable endpoint responsible for creating these subscriptions lacked Cross-Site Request Forgery (CSRF) token validation - the root cause class defined by CWE-352. CSRF attacks exploit the fact that browsers automatically attach session credentials to same-origin requests, enabling an attacker to forge a state-changing HTTP request that the server cannot distinguish from a legitimate one. CPE data (cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*) confirms both the Community and Enterprise editions across the affected version range are vulnerable. The vulnerability was reported via HackerOne (report 3590487) and tracked in GitLab work item 594339.

RemediationAI

Upgrade GitLab CE/EE to one of the patched releases: 18.9.7, 18.10.6, or 18.11.3, as documented in the vendor patch advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. GitLab.com is patched by the vendor automatically. For self-managed instances where an immediate upgrade is not feasible, administrators can disable the GitLab-Jira integration at the instance or group level to eliminate the vulnerable attack surface entirely; note this will interrupt all Jira subscription workflows and event notifications for affected namespaces. As a secondary control, security awareness reminders to users about scrutinizing external links before clicking can reduce delivery success, though this is not a reliable technical control.