Summary.

---

Cross-site request forgery in the GraphQL API (CVE-2026-4922), cross-site scripting in Storybook (CVE-2026-5262), and poor path equivalence handling in Web IDE assets (CVE-2026-5816) have been announced in GitLab CE/EE.
affected products span multiple 16.x-18.x version bands, with specific version ranges for each vulnerability.
the vulnerabilities are resolved through updates to patched versions.

Affected versions and patch versions.

---

• CVE-2026-4922 Affected versions: 17.0 and later but not earlier than 18.9.6, 18.10 and later but not earlier than 18.10.4, 18.11 and later but not earlier than 18.11.1.
• CVE-2026-5262 Affected Versions: 16.1 and later but not earlier than 18.9.6, 18.10 and later but not earlier than 18.10.4, 18.11 and later but not earlier than 18.11.1.
• CVE-2026-5816 Affected Versions: 18.10 and later but not earlier than 18.10.4, 18.11 and later but not earlier than 18.11.1.
• list of patched versions: 18.11.1, 18.10.4, 18.9.6, etc.

Vulnerability details and potential impact.

---

• CVE-2026-4922 is a CSRF vulnerability in the GraphQL API that could allow malformed requests to be made with the privileges of an authenticated user.
• CVE-2026-5262 is an XSS vulnerability in Storybook that could be exploited by a threat actor to inject malicious script for session takeover or privilege escalation.
• CVE-2026-5816 is a lack of path equivalence handling in Web IDE assets, which could allow access control bypass or malicious resource serving through path manipulation.

Recommended actions and notes.

---

• affected versions of GitLab instances should be updated to a patched version (e.g. 18.11.1, 18.10.4, 18.9.6).
• you will need to verify the patch notes for your deployment environment, test them, and roll them out.
• for additional details and release notes, see GitLab’s official patch release documentation.

references: for more information, please visit https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/.