GitLab CE/EE CVE-2026-4527

The victim must be actively authenticated to GitLab at the time they visit the crafted link - the CVSS UI:R component confirms this user interaction is a hard requirement and prevents fully automated exploitation. The targeted namespace must have Jira integration available, as the attack abuses the Jira subscription creation endpoint specifically; namespaces with no Jira integration configured are not exploitable via this vector. The attacker requires no GitLab account or credentials (CVSS PR:N confirms unauthenticated attacker perspective). Exploitation is bounded by the social engineering step required to deliver the malicious link and the dependency on an active victim session. Whether Jira integration must be explicitly enabled by a namespace admin (versus available instance-wide) is inferred from the feature architecture but not explicitly stated in the available disclosure data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 (Medium), with the High confidentiality impact reflecting potential exposure of Jira-integrated project data accessible through an unauthorized subscription. The critical limiting factor is UI:R - victim interaction is mandatory, reducing automatable exploitation; SSVC independently classifies this as non-automatable with partial technical impact and exploitation status of 'none'. EPSS at 0.01% (1st percentile) is consistent with no observed in-the-wild activity and aligns with the CISA KEV absence. No public exploit code has been identified at time of analysis. The real-world risk is meaningfully below what the CVSS C:H rating alone might suggest - this is a social-engineering-dependent attack, not a spray-and-pray network exploit - but the enormous affected version range (11.10 through current 18.x) and widespread enterprise Jira adoption elevate patching urgency above typical medium-severity findings.

An attacker identifies a GitLab user who has an active authenticated session and whose namespace uses the Jira integration. The attacker constructs a URL that, when visited by the authenticated victim, submits a forged POST request to the Jira subscription endpoint on the victim's GitLab instance - the browser transparently attaches the victim's session cookie, satisfying authentication. The attacker delivers this URL via phishing email, chat message, or embedded in a third-party web page, causing an unauthorized Jira subscription to be silently registered against the victim's namespace.