GitLab Patches Critical Unauthenticated GraphQL Vulnerability
GitLab issued an emergency patch for a critical unauthenticated GraphQL flaw (CVE-2026-19478, CVSS 9.4) enabling remote modification or deletion of public projects.
GitLab patched CVE-2026-19478 (CVSS 9.4), an unauthenticated GraphQL directive flaw allowing remote modification or deletion of public projects and user data on self-managed servers. The emergency patch released August 17 covers versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but no fixes exist for the 18.2-18.10 branches. A second issue, a CSRF weakness in GraphQL multiplex queries (CVE-2026-19650, CVSS 7.1), shipped in the same release. No exploitation or public PoC has been observed; the flaw was reported by hiimguardian through HackerOne.
- CVE-2026-19478 (CVSS 9.4) requires no credentials or user interaction to modify or delete public projects
- Patches available for 19.2.4, 19.1.6, 19.0.8, and 18.11.11; branches 18.2-18.10 receive no fix
- CVE-2026-19650 (CVSS 7.1) is a CSRF flaw letting unauthenticated users trigger GraphQL mutations via GET requests
- Reported through HackerOne by hiimguardian; no evidence of in-the-wild exploitation or public PoC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19478+1 related CVE | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 group max | 6% |
From the original article
2 min read at securityaffairs.com
GitLab patched a critical GraphQL flaw that let unauthenticated attackers remotely modify or delete public projects on self-managed servers. GitLab pushed out an emergency patch this week to address a critical flaw, tracked as CVE-2026-19478 (CVSS score of 9. 4), that could let an attacker with zero credentials remotely modify or delete public projects and user data.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.