CVE-2026-4922

CVE-2026-4922 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab Community Edition and Enterprise Edition that affects versions 17.0 through 18.11.1, allowing unauthenticated attackers to execute GraphQL mutations on behalf of authenticated users due to inadequate CSRF protections. The vulnerability stems from insufficient security controls in the GraphQL implementation across multiple affected version branches. The vulnerability carries a CVSS score of 8.1 (HIGH), reflecting a network-based attack vector requiring no privileges but necessitating user interaction. The attack presents high impact potential for both confidentiality and integrity, though availability is not affected. The exploitation requires that an authenticated user interact with a malicious request, but successful execution could enable attackers to perform unauthorized actions within GitLab. Current exploitation status indicates this vulnerability is not actively being exploited in the wild, as evidenced by its absence from the Known Exploited Vulnerabilities catalog and inactive status on the Hot List. While the EPSS score of 0.0008 suggests very low probability of exploitation compared to other CVEs, organizations should prioritize patching affected instances, particularly those exposed to external networks, as the attack methodology is relatively straightforward once access to an authenticated user is established.