Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab urgently patched CVE-2026-19478 (CVSS 9.4), a critical unauthenticated GraphQL flaw allowing modification or deletion of public projects on self-managed instances.
GitLab released an out-of-band critical patch on August 17, 2026 fixing CVE-2026-19478 (CVSS 9.4), a flaw that under certain conditions lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive in Community and Enterprise Editions. Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11; GitLab.com and GitLab Dedicated are already patched, so only self-managed installations need to act. The release also fixes CVE-2026-19650 (CVSS 7.1), a cross-site request forgery flaw in GraphQL multiplex query handling requiring user interaction. No exploitation or public exploit code has been observed as of August 18, 2026.
- Out-of-band patch release issued August 17, 2026, outside the usual schedule
- Fixes in 19.2.4, 19.1.6, 19.0.8, 18.11.11; only self-managed instances affected
- Second flaw CVE-2026-19650 is CSRF in GraphQL multiplex query handling (CVSS 7.1)
- No exploitation observed and no public exploit code as of August 18, 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19478+1 related CVE | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 group max | 6% |
From the original article
2 min read at thehackernews.com
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478 , has been rated Critical by GitLab and assigned a CVSS score of 9. 4.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.