Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.
GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.
- CVE-2026-19478 (CVSS 9.4): unauthenticated code injection via GraphQL directive enables modifying or deleting public projects.
- CVE-2026-19650 (CVSS 7.1): CSRF in the GraphQL multiplex query handler allows mutations via GET requests with user interaction.
- Affected CE/EE branches 18.2-19.2; fixed in 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
- GitLab.com and GitLab Dedicated are already patched; self-managed installations should upgrade immediately.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19478+1 related CVE | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 group max | 6% |
From the original article
1 min read at helpnetsecurity.com
GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18. 2 before 18.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.