Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.
GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.
- CVE-2026-19478 (CVSS 9.4): unauthenticated code injection via GraphQL directive enables modifying or deleting public projects.
- CVE-2026-19650 (CVSS 7.1): CSRF in the GraphQL multiplex query handler allows mutations via GET requests with user interaction.
- Affected CE/EE branches 18.2-19.2; fixed in 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
- GitLab.com and GitLab Dedicated are already patched; self-managed installations should upgrade immediately.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19478 +1 in the same advisory: …19650 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue. Do: Upgrade all GitLab CE/EE instances to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) immediately, prioritizing internet-facing instances given confirmed active exploitation. Until patched, restrict unauthenticated access to the GraphQL API endpoint at the network or WAF layer. Review instance audit logs and public projects for signs of unauthorized modifications or deletions of projects and user data. | 9.1 group max | 6% |
| massmillions of users (GitLab.com SaaS runs the same code) plus tens of thousands of internet-exposed self-managed CE/EE instances |
Full article228 words · extracted from helpnetsecurity.com · click to collapse
GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication.
The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” the company said.
“GitLab.com and GitLab Dedicated are already running the patched version. GitLab.com and GitLab Dedicated customers do not need to take action,” they added.
The more severe vulnerability, CVE-2026-19478 (CVSS 9.4), involves code injection through a GraphQL directive and can be exploited remotely by an unauthenticated attacker without user interaction. Successful exploitation could allow an attacker to modify or delete public projects and user data.
The second vulnerability, CVE-2026-19650 (CVSS 7.1), is a cross-site request forgery issue in the GraphQL multiplex query handler. Improper request validation could allow an unauthenticated attacker to “execute mutations via GET requests,” though exploitation requires user interaction.
“We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards,” the company concluded.
Both vulnerabilities were reported through GitLab’s HackerOne bug bounty program.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/18/gitlab-critical-code-injection-flaw-cve-2026-19478/