Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-17T20:16:41.910Z",
  "pubdate": "2026-08-17T20:16:41.910Z",
  "executiveSummary": "An improper request validation vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) related to GraphQL multiplex query handling. Under specific operational conditions, this flaw permits unauthenticated remote attackers to execute unauthorized state-changing operations, known as mutations, by issuing standard HTTP GET requests rather than restricted POST requests.\nThe vulnerability impacts GitLab versions 18.2 prior to 18.11.11, 19.0 prior to 19.0.8, 19.1 prior to 19.1.6, and 19.2 prior to 19.2.4. Successful exploitation bypasses HTTP method constraints enforced by the application layer, potentially leading to unauthorized data modification, integrity compromise, or execution of sensitive actions within the target instance without requiring prior authentication or valid session credentials.\nThe risk implications are severe due to the unauthenticated nature of the attack vector and the potential for automated exploitation against exposed GitLab endpoints. Mitigation requires immediate application of the officially released security patches provided by GitLab for the respective affected version branches.",
  "technicalDetails": "The root cause of the vulnerability stems from improper request validation and insufficient enforcement of HTTP method constraints within the GraphQL multiplex query handling subsystem of GitLab CE and EE. Typically, GraphQL implementations restrict state-mutating operations (mutations) to HTTP POST requests to prevent Cross-Site Request Forgery (CSRF) and ensure proper semantic separation between read-only queries and state-changing mutations. However, flawed parsing and validation logic in the affected version ranges failed to adequately restrict mutations when processed via multiplexed query structures submitted through HTTP GET requests.\nThe vulnerable component is the GraphQL API endpoint responsible for handling batch and multiplexed queries. Because HTTP GET requests are commonly processed via URL query parameters, an unauthenticated attacker can craft a malicious HTTP GET request containing a multiplexed GraphQL payload. This payload bundles multiple operations together, specifically embedding mutation operations that modify application state.\nThe attack flow proceeds as follows: First, the attacker identifies a publicly accessible or exposed GitLab GraphQL endpoint. Second, the attacker crafts a specially formatted HTTP GET request incorporating a GraphQL multiplex query structure. Third, the request is transmitted to the GitLab server over the network without any authentication headers or session tokens. Fourth, the application's request validation layer incorrectly processes the multiplexed structure, failing to reject mutation operations submitted via the GET method. Finally, the GraphQL engine executes the embedded mutations, allowing the unauthenticated user to perform unauthorized state changes.\nThe affected versions encompass all installations of GitLab CE and EE from version 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. The prerequisites for exploitation include network exposure to the GitLab GraphQL API endpoint and specific operational conditions governing multiplex query processing. Post-exploitation impact includes unauthorized data manipulation, potential creation of privileged entities, or execution of administrative functions depending on the precise mutations supported and processed by the misconfigured endpoint."
}