A vulnerability in GitLab CE/EE allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users, presenting a significant risk to application integrity.

This is a Cross-Site Request Forgery (CWE-352) vulnerability. The flaw exists because of insufficient CSRF protection, which allows an unauthenticated attacker to force an authenticated user to execute GraphQL mutations without their consent.

Successful exploitation allows an attacker to perform actions within the GitLab environment under the identity of an authenticated user. Given the CVSS score of 8.1, this is a high-severity issue that could lead to unauthorized data modification, account takeover, or the manipulation of development workflows, potentially resulting in severe operational disruption and loss of trust in the integrity of the CI/CD pipeline.

Immediate Action: Upgrade GitLab CE/EE instances immediately to version 18.9.6, 18.10.4, 18.11.1, or any higher version provided by the vendor.

Proactive Monitoring: Monitor access logs and GraphQL mutation endpoints for unusual patterns or requests originating from unexpected sources that do not correspond to legitimate user activity.

Compensating Controls: Ensure that SameSite cookie attributes are strictly enforced and consider implementing additional authentication challenges for sensitive mutations if immediate patching is delayed.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked HackerOne report (https://hackerone.com/reports/3627285).

The high severity of this vulnerability, combined with the availability of a published proof-of-concept, necessitates immediate action. Security teams must prioritize patching their GitLab environments to the specified versions to prevent unauthorized execution of GraphQL mutations and protect the integrity of their development infrastructure.