CVE-2026-4527 MEDIUM

CVE-2026-4527: Cross-Site Request Forgery (CSRF) in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-352 · CSRF
Published May 14, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

Key dates

02Disclosure timeline

May 14, 2026 CVE published
May 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-54694 WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2024-24819 icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF CVE-2023-29425 WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-23989 WordPress Internal Link Builder plugin <= 1.0 - CSRF to Stored XSS vulnerability CVE-2025-32267 WordPress WP to Hootsuite plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability