EUVD-2026-30230
GHSA-rw3w-8j7h-fwr2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.
AnalysisAI
Cross-Site Request Forgery in GitLab CE/EE allows an unauthenticated attacker to create unauthorized Jira subscriptions within a targeted authenticated user's namespace by tricking the victim into clicking a specially crafted link. All GitLab installations from version 11.10 through the pre-patch 18.x releases are affected across both Community and Enterprise editions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be actively authenticated to GitLab at the time they visit the crafted link - the CVSS UI:R component confirms this user interaction is a hard requirement and prevents fully automated exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 (Medium), with the High confidentiality impact reflecting potential exposure of Jira-integrated project data accessible through an unauthorized subscription. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a GitLab user who has an active authenticated session and whose namespace uses the Jira integration. The attacker constructs a URL that, when visited by the authenticated victim, submits a forged POST request to the Jira subscription endpoint on the victim's GitLab instance - the browser transparently attaches the victim's session cookie, satisfying authentication. … |
| Remediation | Upgrade GitLab CE/EE to one of the patched releases: 18.9.7, 18.10.6, or 18.11.3, as documented in the vendor patch advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Two-factor authentication bypass in syracom AG Secure Login (2FA) plugin 3.4.0.x for Atlassian Jira, Confluence, and Bit
Remote code execution in GeoServer (versions prior to 2.27.0) with the DB2 extension installed allows authenticated admi
Arbitrary file write in GeoServer's Master Password Dump web page allows an authenticated administrator to write attacke
Server-Side Request Forgery in GeoServer's XML entity resolution allows unauthenticated remote attackers to cause the se
Share
External POC / Exploit Code
Leaving vuln.today