Authenticated mutation execution via GraphQL GET CSRF

CSRF in GitLab GraphQL multiplex handling before 18.11.11, 19.0.8, 19.1.6, and 19.2.4 allows attackers to execute mutations via crafted GET requests. In affected requests, GitLab validates the multiplex payload for forbidden mutations but still executes the regular query path, creating a validation and execution mismatch that lets a pseudo-IntrospectionQuery smuggle a mutation through a GET. Exploitation requires user interaction with attacker-controlled content in a victim browser session, after which state-changing GraphQL actions run with that victim's existing permissions.