GitLab contained a CSRF flaw that allowed an unauthenticated user to trigger GraphQL mutations on behalf of any logged‑in user. Because the mutation endpoint accepted requests without a CSRF token, an attacker could cause the victim to change settings, delete data, or otherwise perform privileged actions. The weakness is a classic CSRF vulnerability (CWE‑352).

The flaw affects GitLab CE/EE from version 17.0 through the release immediately before 18.9.6, from 18.10.0 to just before 18.10.4, and from 18.11.0 to just before 18.11.1. All other supported releases are unaffected.

The CVSS score of 8.1 indicates a high severity. EPSS is not available, so the likelihood of exploitation is unknown, but the flaw is listed outside the KEV catalog. Based on the description, it is inferred that the attacker would deliver a crafted GraphQL mutation request from a malicious site to an authenticated victim's browser. The likely attack vector thus involves a victim already logged in visiting a site that submits a mutation request without a CSRF token, causing the action to execute with the victim's privileges. Given the high impact and lack of mitigation in those versions, the risk to exposed installations is significant.