A flaw in GitLab’s GraphQL API implements insufficient Cross‑Site Request Forgery protection, classified as CWE-352, allowing an unauthenticated attacker to trigger any GraphQL mutation on behalf of an authenticated user. The vulnerability enables the attacker to read, modify, or delete data that the victim is authorized to access, compromising both data confidentiality and integrity.

The issue affects all GitLab Community Edition and Enterprise Edition releases from 17.10 up to, but excluding, versions 18.8.7, 18.9.3, and 18.10.1. This includes the 17.10‑18.8.6 series, the 18.9‑18.9.2 series, and the 18.10‑18.10.0 series. Only patches beginning with 18.8.7, 18.9.3, or 18.10.1 in the respective branches remove the weakness.

The CVSS v3.1 score of 8.1 indicates high severity, but the EPSS score is below 1 %, suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a malicious URL or embedded script that coerces the victim’s browser into sending an authenticated GraphQL request without a valid CSRF token, thereby executing the attacker’s chosen mutation.