CVE-2026-19650

GitLab CE/EE contains an improper request-validation flaw (CWE-352, CSRF) in GraphQL multiplex query handling that, under certain conditions, allowed mutations to be executed via GET requests, which should normally only carry queries. An unauthenticated attacker can exploit this by inducing GET requests against a vulnerable instance's GraphQL endpoint; the CVSS user-interaction requirement indicates a logged-in user's browser is typically the vehicle, and no credentials or privileges are needed by the attacker. Successful exploitation carries no confidentiality impact but a high integrity impact and low availability impact (CVSS 7.1), meaning attackers could modify data and potentially delete resources such as project content. All self-managed GitLab CE/EE deployments running affected trains (18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, or 19.2 through 19.2.3) are exposed; related coverage notes GitLab's same patch release also fixed a companion critical GraphQL flaw (CVE-2026-19478) letting attackers modify or delete public projects. There is no known in-the-wild exploitation, public proof-of-concept, or KEV listing, and EPSS assigns only a 0.5% probability of exploitation within 30 days.

What to do: Upgrade self-managed GitLab CE/EE to 18.11.11, 19.0.8, 19.1.6, or 19.2.4, matching your current train (18.2+, 19.0, 19.1, or 19.2); patch promptly because the same release also fixed a related critical unauthenticated GraphQL flaw that could let attackers modify or delete public projects. Until patched, review audit logs for unexpected project modifications or deletions initiated via GraphQL, since the GET-driven, CSRF-style vector may have left changes attributed to legitimate logged-in users. GitLab.com SaaS is operated and patched by the vendor, so remediation priority falls on self-managed instances.