CCB Belgium Warns of 11 Critical GitLab Vulnerabilities, Patch Immediately
Summary
On 22 April 2026, GitLab released patches addressing 11 vulnerabilities affecting GitLab Community Edition and Enterprise Edition across versions prior to 18.11.1. Three vulnerabilities carry critical CVSS scores: CVE-2026-4922 (8.1) is a cross-site request forgery in the GraphQL API allowing unauthenticated execution of mutations on behalf of authenticated users; CVE-2026-5816 (8.0) is a path equivalence flaw enabling arbitrary JavaScript execution via Web IDE assets; CVE-2026-5262 (8.0) is a cross-site scripting vulnerability in Storybook potentially exposing authentication tokens. At the time of publication, no active exploitation had been confirmed. The Centre for Cybersecurity Belgium strongly recommends immediate patching after testing and implementation of Content Security Policy headers.
“The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.”
Organisations running self-hosted GitLab instances should treat this as a Priority review item: CVE-2026-4922 allows unauthenticated CSRF attacks against authenticated users via GraphQL API, meaning any user who clicks a crafted link could have project settings, permissions, or issue data modified without their knowledge. The advisory's explicit mention that threat actors have previously targeted GitLab to host and distribute malware raises the stakes for development environments with CI/CD pipelines, where a compromised runner could be repurposed for supply-chain attacks. Security teams should confirm whether their GitLab version predates 18.11.1, apply the patch after testing, and audit GraphQL mutation permissions as a compensating control.
About this source
GovPing monitors Belgium CCB News alt for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 6 changes logged to date.
What changed
The Centre for Cybersecurity Belgium issued an emergency cybersecurity advisory covering 11 newly patched vulnerabilities in GitLab software development platform. The most severe are CVE-2026-4922 (CSRF in GraphQL API, CVSS 8.1), CVE-2026-5816 (path equivalence flaw enabling JavaScript execution, CVSS 8.0), and CVE-2026-5262 (XSS in Storybook exposing tokens, CVSS 8.0). Eight additional vulnerabilities range from medium to low severity. No evidence of active exploitation was identified at cut-off date 23 April 2026. The advisory represents new guidance from the Belgian national cybersecurity authority superseding any prior GitLab vulnerability communications. Affected parties should treat this as Priority review and take immediate patching action. While the vulnerabilities affect GitLab's global user base, this specific advisory originates from Belgium and carries national authority weight for Belgian entities and EU-connected organisations using the platform.
What to do next
- Install updates for vulnerable GitLab CE and EE installations immediately after testing
- Implement Content Security Policy headers to harden against cross-site request forgery attacks
- Monitor GitLab logs for suspicious JavaScript execution, cross-site scripting attempts, and unauthorised token usage
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Warning: 11 new vulnerabilities in GitLab CE and EE editions, Patch Immediately!
Image
Published : 24/04/2026
- Last update: 24/04/2026
- Affected software: → GitLab Community Edition → GitLab Enterprise Edition
- Type: Code execution, Denial of service, Information disclosure
- CVE/CVSS → CVE-2026-4922 CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) → CVE-2026-5816 CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) → CVE-2026-5262 CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) → CVE-2025-0186 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) → CVE-2026-1660 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) → CVE-2025-6016 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) → CVE-2025-3922 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) → CVE-2026-6515 CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) → CVE-2026-5377 CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) → CVE-2026-3254 CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) → CVE-2025-9957 CVSS 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Sources
GitLab advisory - https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/
Risks
On 22 April 2026, GitLab addressed 11 vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerabilities differ in severity, ranging from low to high severity. This advisory will cover the 3 vulnerabilities with the highest severity CVSS scores: CVE-2026-4922, CVE-2026-5816 and CVE-2026-5262.
GitLab is an open-source platform used for software development that is popular across the world. Threat actors have been known to target GitLab instances, for instance to host and distribute malware.
As of the time of writing, there is no indication these vulnerabilities are actively exploited (cut-off date: 23 April 2026).
Description
CVE-2026-4922 is a cross-site request forgery vulnerability affecting the GraphQL API. Insufficient CSRF protection in GitLab GraphQL API allows unauthenticated users to execute GraphQL mutations on behalf of authenticated users. An attacker can craft malicious requests that, when clicked by an authenticated GitLab user, execute GraphQL mutations without the user's knowledge or consent. This could result in unauthorised modification of data and configurations within GitLab, including potential changes to project settings, user permissions, issue management, and other critical GitLab functionality.
CVE-2026-5816 is an improper resolution of path equivalence flaw affecting Web IDE assets. An unauthenticated user could exploit it to execute arbitrary JavaScript in a user’s browser session. This could lead to session hijacking, credential theft, unauthorised actions performed on behalf of the user, and potential access to sensitive data.
CVE-2026-5262 is a cross-site scripting vulnerability affecting Storybook. Under certain conditions, an unauthenticated attacker could exploit this vulnerability to gain unauthorised access to sensitive tokens stored in the Storybook development environment. This could lead to the compromise of authentication credentials, allowing attackers to authenticate as legitimate users and perform actions on the GitLab instance.
Recommended Actions
Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.
The CCB also recommends implementing Content Security Policy headers to harden against cross-site request forgery attacks.
Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.
The CCB recommends monitoring for, reviewing, any suspicious JavaScript execution, cross-site scripting attempts, and unauthorised token usage in your GitLab logs.
In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
References
Feedly - https://feedly.com/cve/CVE-2026-4922
Feedly - https://feedly.com/cve/CVE-2026-5816
Feedly - https://feedly.com/cve/CVE-2026-5262
Related changes
Get daily alerts for Belgium CCB News alt
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CCB.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Belgium CCB News alt publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.