GitLab: unauthenticated GraphQL mutations executed via GET through multiplex query handling

Impact

Improper request validation in GraphQL multiplex handling lets mutations run over GET requests, which the record scores as reachable by an unauthenticated user with user interaction required — the classic shape of a link that a logged-in maintainer clicks and that then performs a state change as them. Against the GitLab instance that drives a GPU cluster's pipelines and GitOps repos, a mutation executed as a privileged user is a write into the deployment path. Integrity is rated high; confidentiality is unaffected. The affected range is wide, spanning 18.2 through 19.2.

Who can reach it

Unauthenticated attacker who can get a target with an active GitLab session to issue the request (UI:R in the vector); reachable over the network wherever the GitLab GraphQL endpoint is exposed.

What to do

Upgrade to GitLab 18.11.11, 19.0.8, 19.1.6 or 19.2.4 depending on your branch, then restart the service. This is a routine GitLab patch upgrade with no node maintenance; because the affected range goes back to 18.2, check which branch each self-managed instance and runner-adjacent deployment is on before scheduling.

References