GitLab Security Update: High-Severity Vulnerabilities Patched in April Release

GitLab released urgent security updates (April 22, 2026) for self-managed CE/EE instances (18.11.1, 18.10.4, 18.9.6) addressing multiple vulnerabilities — notably CVE-2026-4922 (GraphQL API CSRF), CVE-2026-5816 (Web IDE arbitrary JavaScript), CVE-2026-5262 (Storybook token access) — that could allow unauthenticated attackers to perform actions as users, execute JavaScript in user sessions, or access tokens; additional medium/low issues fix DoS vectors, access-control lapses, and virtual registry credential misuse, and administrators are advised to upgrade immediately.