CVE-2026-78252: GitLab CE/EE CSRF Vulnerability

CVE-2026-78252 Overview

CVE-2026-78252 is a cross-site request forgery (CSRF) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from improper sanitization of user-controlled data in the Markdown JSON table renderer. An authenticated attacker can craft malicious Markdown content that induces a targeted user to perform unintended state-changing HTTP requests when rendered. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and impacts confidentiality, integrity, and availability with a scope change indicator.

Critical Impact
An authenticated user can coerce a victim into executing unintended state-changing requests, potentially altering repository configuration, permissions, or project data under the victim's session context.

Affected Products

GitLab CE/EE versions 15.3 through 19.1.7
GitLab CE/EE versions 19.2 through 19.2.5
GitLab CE/EE versions 19.3 through 19.3.1

Discovery Timeline

2026-09-16 - CVE-2026-78252 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78252

Vulnerability Analysis

The vulnerability resides in GitLab's Markdown rendering pipeline, specifically the JSON table renderer component. GitLab's Markdown flavor supports embedded JSON tables for structured data presentation across issues, merge requests, comments, and wiki pages. The renderer fails to properly sanitize user-controlled fields before injecting them into rendered HTML output. This allows an authenticated attacker to embed content that triggers state-changing HTTP requests when a target user views the rendered page. Because GitLab authenticates users through session cookies, requests originating from the victim's browser inherit the victim's privileges. The scope change indicator reflects that the exploited component (Markdown renderer) can affect resources beyond its immediate security context.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied JSON fields processed by the Markdown table renderer. The renderer trusts input structure without neutralizing HTML or attribute-context payloads that can bootstrap CSRF-style behavior. This aligns with [CWE-79], where user-controlled data reaches an output sink without appropriate contextual escaping.

Attack Vector

Exploitation requires an authenticated attacker with permission to post Markdown content in a location a victim will view, such as an issue, merge request, comment, or wiki page. The attacker crafts a JSON table payload containing malicious markup. When the victim loads the page, their browser issues state-changing requests to GitLab endpoints using the victim's session. Successful exploitation depends on user interaction (viewing the crafted content) and specific conditions being met, which raises attack complexity. Refer to the HackerOne Report #3917471 and GitLab Work Item #621447 for additional technical context.

Detection Methods for CVE-2026-78252

Indicators of Compromise

Unexpected state-changing API calls (project setting updates, membership changes, token creation) originating from user sessions shortly after those users viewed issues, merge requests, or wiki pages.
Markdown content containing embedded JSON table blocks with unusual attribute payloads or embedded HTML fragments in user-generated fields.
Audit log entries showing configuration changes performed by users who did not intentionally initiate the action.

Detection Strategies

Review GitLab audit events for correlations between page-view activity and subsequent state-changing requests from the same session within seconds.
Inspect Markdown submissions across issues, comments, and wikis for JSON table blocks introduced after the vulnerability window opened.
Query web access logs for POST, PUT, PATCH, and DELETE requests preceded by GET requests to Markdown-rendering endpoints with matching referrers.

Monitoring Recommendations

Enable and forward GitLab application, audit, and production logs to a centralized analytics platform for correlation across user sessions.
Alert on privileged actions (role changes, personal access token creation, protected branch modifications) that occur without a corresponding UI navigation trail.
Track upgrade status of self-managed GitLab instances against the fixed versions listed in the vendor advisory.

How to Mitigate CVE-2026-78252

Immediate Actions Required

Upgrade self-managed GitLab CE/EE instances to version 19.1.8, 19.2.6, or 19.3.2 as applicable per the vendor advisory.
Audit recent Markdown content in high-visibility projects for suspicious JSON table blocks and remove any that reference unexpected endpoints.
Review audit logs for state-changing actions performed by administrative users during the exposure window.

Patch Information

GitLab addressed the issue in versions 19.1.8, 19.2.6, and 19.3.2. Full release notes and upgrade instructions are available in the GitLab Patch Release 19.3.2 advisory. GitLab.com SaaS instances are already patched.

Workarounds

No official workaround is published; upgrading to a fixed version is the recommended remediation path.
Restrict Markdown submission privileges on sensitive projects until patching completes.
Educate administrators to avoid viewing untrusted issues, merge requests, or wiki pages authored by low-trust accounts during the exposure window.

bash

# Configuration example: verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Expected version: 19.1.8, 19.2.6, or 19.3.2 (or later)