CVE-2026-3857
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.
Summary dbcve.org
GitLab CE/EE versions 17.10 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1 contain a CSRF protection bypass in the GraphQL API. Unauthenticated attackers can craft malicious requests that trick authenticated users' browsers into executing arbitrary GraphQL mutations (such as modifying projects, changing settings, or exfiltrating data) without the users' knowledge or consent.
Mitigation
Upgrade GitLab to version 18.8.7, 18.9.3, or 18.10.1 or later. After upgrading, verify that GraphQL endpoints properly enforce CSRF token validation and consider implementing SameSite cookie attributes for additional defense-in-depth.