GitLab.com

Related CVEsby mentions

• CVE-2026-194789.16%
  Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
  GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue.
  · GitLab CE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 · GitLab EE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4mass
• CVE-2026-196507.1<1%
  CSRF Flaw in GitLab CE/EE GraphQL Lets GET Requests Execute Mutations
  GitLab CE/EE contains an improper request-validation flaw (CWE-352, CSRF) in GraphQL multiplex query handling that, under certain conditions, allowed mutations to be executed via GET requests, which should normally only carry queries. An unauthenticated attacker can exploit this by inducing GET requests against a vulnerable instance's GraphQL endpoint; the CVSS user-interaction requirement indicates a logged-in user's browser is typically the vehicle, and no credentials or privileges are needed by the attacker. Successful exploitation carries no confidentiality impact but a high integrity impact and low availability impact (CVSS 7.1), meaning attackers could modify data and potentially delete resources such as project content. All self-managed GitLab CE/EE deployments running affected trains (18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, or 19.2 through 19.2.3) are exposed; related coverage notes GitLab's same patch release also fixed a companion critical GraphQL flaw (CVE-2026-19478) letting attackers modify or delete public projects. There is no known in-the-wild exploitation, public proof-of-concept, or KEV listing, and EPSS assigns only a 0.5% probability of exploitation within 30 days.
  · GitLab CE/EE (Community Edition and Enterprise Edition) all versions from 18.2 before 18.11.11; 19.0 before 19.0.8; 19.1 before 19.1.6; 19.2 before 19.2.4large

Appears with