Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Affected products
gitlab: gitlab
References3
- docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-re… Vendor Advisory
- gitlab.com/gitlab-org/gitlab/-/work_items/612617 Not Applicable
- hackerone.com/reports/3903669 Permissions Required
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L - EPSS — exploit probability
- 0% percentile: 12 · as of 11 November 2026
- CWE
- CWE-352
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.