GitLab suffered a CSRF flaw that let an unauthenticated attacker send GET requests containing GraphQL mutations. The server failed to validate the request properly, allowing the mutation to be executed. The result is that an attacker can create, update, or delete repository data, issues, and other critical assets without knowing any credentials. The weakness is a classic example of improper request validation (CWE-352).

All GitLab Community and Enterprise editions from 18.2 up to 18.11.10, from 19.0 up to 19.0.7, from 19.1 up to 19.1.5, and from 19.2 up to 19.2.3 are vulnerable. This includes both self‑hosted and on‑premise GitLab instances. All affected releases are documented as part of the GitLab CE/EE product line.

The CVSS score of 7.1 signals a high impact and the vulnerability is exploitable without authentication, so any user who can reach the vulnerable instance can craft a malicious link or embed a request in a page and trigger the mutation. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the attack vector remains straightforward: a simple crafted URL can induce the server to perform a destructive operation. The lack of CSRF protection and improper request handling make the bug an easy target for attackers who wish to modify data or cause unintended changes. No prerequisites beyond reaching the GitLab service are required, and the exploit can operate in a purely HTTP context.