What is the CVSS score of CVE-2026-4922?

CVE-2026-4922 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4922?

Yes, a public proof-of-concept exploit is available for CVE-2026-4922. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4922?

Within 24 hours: Identify all GitLab CE/EE instances and document current versions in use. Within 7 days: Apply vendor patches-upgrade to GitLab 18.9.6, 18.10.4, or 18.11.1 depending on your current version line; test patched versions in a staging environment before production deployment. Within 30 days: Conduct user awareness training on phishing and social engineering; review GitLab access logs for suspicious GraphQL mutation activity; implement additional CSRF protections at the reverse proxy or WAF level if available.

GitLab CE/EE CVE-2026-4922

Q: Which versions of GitLab CE/EE are affected by CVE-2026-4922?

GitLab CE/EE versions 17.0-18.11.0 contain a CSRF vulnerability (CVSS 8.1) enabling attackers to execute GraphQL mutations as authenticated users through malicious web pages, requiring user…. A patch is available.

EUVD-2026-25040 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 GitLab

CSRF Gitlab

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 20:54 vuln.today

cvss_changed

PoC Detected

Apr 23, 2026 - 20:40 vuln.today

Public exploit code

Patch released

Apr 23, 2026 - 20:40 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 06:50 vuln.today

Patch available

Apr 22, 2026 - 17:33 EUVD

EUVD ID Assigned

Apr 22, 2026 - 17:01 euvd

EUVD-2026-25040

Analysis Generated

Apr 22, 2026 - 17:01 vuln.today

CVE Published

Apr 22, 2026 - 16:29 nvd

HIGH 8.1

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

AnalysisAI

Cross-Site Request Forgery (CSRF) in GitLab CE/EE allows remote unauthenticated attackers to execute GraphQL mutations as authenticated victims through crafted web pages. Affects all versions from 17.0 through 18.11.0, with publicly available exploit code (HackerOne report 3627285). Despite high CVSS 8.1, exploitation requires user interaction (phishing/social engineering) and is not automatable per CISA SSVC framework. No evidence of active exploitation in CISA KEV at time of analysis. Vendor patches released: 18.9.6, 18.10.4, and 18.11.1.

Technical ContextAI

This vulnerability stems from insufficient CSRF token validation in GitLab's GraphQL API endpoint (CWE-352). GraphQL mutations are state-changing operations that should require anti-CSRF protection when invoked from browser contexts. The affected cpe:2.3:a:gitlab:gitlab covers both Community Edition (CE) and Enterprise Edition (EE). CSRF attacks exploit the browser's automatic inclusion of authentication cookies with cross-origin requests. Without proper token validation, an attacker-controlled site can trigger authenticated GraphQL operations in the victim's browser session. The vulnerability exists in GitLab's web application layer where GraphQL mutation endpoints failed to validate CSRF tokens, allowing forged requests from malicious third-party sites to execute with the victim's authenticated session privileges.

RemediationAI

Immediately upgrade to patched versions: 18.9.6 (for 17.x-18.9 series), 18.10.4 (for 18.10 series), or 18.11.1 (for 18.11 series) per GitLab's advisory at https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/. If immediate patching is not feasible, implement interim controls: configure web application firewalls to enforce SameSite cookie attributes (SameSite=Strict or Lax) for GitLab session cookies, though this requires infrastructure changes and may break legitimate cross-origin workflows. Deploy Content Security Policy headers to restrict frame-ancestors and form-action directives, preventing GitLab pages from being embedded in attacker sites, but verify compatibility with existing integrations. Educate users to avoid clicking external links while authenticated to GitLab and to use separate browser profiles for administrative GitLab access versus general web browsing, recognizing this introduces operational friction. Network-level controls (IP allowlisting) do not mitigate CSRF as attacks originate from the victim's browser, not the attacker's infrastructure. Monitor GraphQL mutation logs for anomalous activity patterns, though this provides detection rather than prevention.