Loading story…
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. CVE-2026-4922 is a cross-site request forgery flaw (CWE-352) that could let an attacker trigger GraphQL mutations as an authenticated user, while CVE-2026-5262 is a cross-site scripting issue (CWE-79) that could expose tokens in the Storybook development environment. GitLab also fixed CVE-2026-5816, an improper path validation flaw (CWE-41) that could allow arbitrary JavaScript execution in a victim’s browser session.
The issues affect multiple GitLab CE/EE release lines, with patched versions identified as 18.9.6, 18.10.4, and 18.11.1 depending on the flaw. CVE-2026-4922 affects versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1; CVE-2026-5262 affects versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1; and CVE-2026-5816 affects 18.10 before 18.10.4 and 18.11 before 18.11.1. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-4922 was newly received by cve@gitlab.com, indicating formal CVE intake for the CSRF issue affecting GitLab CE/EE. The record tied the vulnerability to GitLab's April 22 patch release and related disclosure artifacts.
GitLab disclosed details for three high-severity vulnerabilities on April 22, 2026, including affected versions, impact, CWE classifications, and CVSS vectors. The disclosures stated the flaws had been remediated and referenced GitLab patch release notes, internal work items, and HackerOne reports.
GitLab issued patched releases 18.9.6, 18.10.4, and 18.11.1 to remediate three vulnerabilities affecting GitLab CE/EE: CVE-2026-4922 (CSRF in GraphQL mutations), CVE-2026-5262 (XSS/input validation issue exposing tokens in Storybook), and CVE-2026-5816 (path equivalence issue enabling arbitrary JavaScript execution). The fixes covered affected version ranges spanning 16.1.0 through 18.11 depending on the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab disclosed and remediated two high-severity vulnerabilities in GitLab CE/EE that could expose sensitive data and enable unauthorized actions. **CVE-2026-3857** is a `CWE-352` cross-site request forgery flaw in GitLab GraphQL functionality caused by insufficient CSRF protection, allowing an unauthenticated attacker to trigger arbitrary GraphQL mutations on behalf of an authenticated user if that user can be induced to interact. The issue affects versions from `17.10` before `18.8.7`, `18.9` before `18.9.3`, and `18.10` before `18.10.1`. GitLab also fixed **CVE-2026-5173**, a `CWE-749` improper access control issue that lets an authenticated user invoke unintended server-side methods over websocket connections. That flaw affects versions from `16.9.6` before `18.8.9`, `18.9` before `18.9.5`, and `18.10` before `18.10.3`, with GitLab rating it as network-exploitable with low attack complexity and significant confidentiality impact. GitLab published patch release information and related work items for both vulnerabilities, urging customers to update affected self-managed deployments to the fixed releases.
Jun 29, 2026
GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.
Jul 9, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026