GitLab has released emergency security updates after discovering a critical vulnerability that could allow unauthenticated attackers to remotely modify or delete public projects and user data.
The flaw, tracked as CVE-2026-19478, affects GitLab Community Edition and Enterprise Edition installations across multiple supported versions.
Administrators operating self-managed GitLab servers are being urged to update immediately, particularly organizations with internet-facing instances, public repositories, or externally accessible GraphQL services.
GitLab Critical Vulnerability
GitLab Dedicated is already running the patched release, meaning customers using those hosted services do not need to take action.
The company issued GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 on August 17, 2026. The releases were published as an ad hoc critical patch rather than part of GitLab’s normal twice-monthly security update schedule.
CVE-2026-19478 is a code injection issue involving a GraphQL directive. Under certain conditions, the vulnerability could enable a remote, unauthenticated user to alter or delete public projects and user data.
The issue received a CVSS severity score of 9.4 out of 10, reflecting its potential for high impact on integrity and availability without requiring credentials, victim interaction, or complex exploitation conditions.
Affected installations include GitLab CE and EE versions from 18.2 through 18.11.11; GitLab 19.0 versions from 19.0.0 through 19.0.8; GitLab 19.1 versions from 19.1.0 through 19.1.6; and GitLab 19.2 versions from 19.2.0 through 19.2.4.
Because the vulnerable functionality may be accessible remotely, the risk is particularly significant for organizations that use GitLab as a central platform for software development, source code hosting, CI/CD operations, and release management.
An attacker capable of deleting or modifying public project content could disrupt development workflows, tamper with repositories, interfere with documentation, or create downstream supply-chain concerns for projects that distribute code publicly.
GitLab also addressed a second GraphQL-related vulnerability, CVE-2026-19650, rated High with a CVSS score of 7.1. This issue is a cross-site request forgery flaw in the GraphQL multiplex query handler.
Improper request validation could allow unauthenticated users to execute mutations through GET requests.
Exploitation requires user interaction, making it less severe than the critical code injection flaw, but it could still enable unauthorized state-changing operations if a targeted user is persuaded to open a specially crafted request.
GitLab said the patched versions do not contain new migrations and that multi-node deployments should not require downtime when organizations follow the documented zero-downtime upgrade process.
Administrators should nevertheless account for the default behavior of Omnibus packages, which stop GitLab services, run migrations, and restart them during updates unless otherwise configured.
Beyond patching, defenders should review audit trails and repository activity for unexplained deletions, unexpected project changes, suspicious GraphQL requests, altered user data, or unusual API activity. Organizations should also confirm that backups are current and access controls are properly configured.
The vulnerabilities highlight how flaws in GraphQL request handling can create serious risks when exposed interfaces permit sensitive project-management actions.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
