Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user…
Intelligence analysis by Llama
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4.
Imagine you have a public project on a website where you can share your work with others. But, there's a bug in the website's code that allows someone to delete your project without needing a password. This is what happened with GitLab, a website where developers share their projects. A bug in their code allowed someone to delete public projects and user data without needing a password.
Analysis
Vulnerability Details
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. The vulnerability could allow an unauthenticated attacker to remotely modify or delete public projects and user data via a GraphQL directive.
Affected Versions
The following versions are affected:
- All versions from 18.2 before 18.11.11
- 19.0 before 19.0.8
- 19.1 before 19.1.6
- 19.2 before 19.2.4
Fixes
The fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range. GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Second Issue Fixed
The second issue fixed in the release, CVE-2026-19650, has been rated High by GitLab with a CVSS score of 7.1, and concerns a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler. Unlike the critical flaw, it requires user interaction to work.
Key points
- GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software.
- The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4.
- The vulnerability could allow an unauthenticated attacker to remotely modify or delete public projects and user data via a GraphQL directive.
- The fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range.
- The second issue fixed in the release, CVE-2026-19650, has been rated High by GitLab with a CVSS score of 7.1, and concerns a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler.
If the vulnerability is patched quickly, it's possible that the impact will be minimal, and users will not lose any data. Additionally, the fact that GitLab has released security updates to address the issue shows that they are taking the problem seriously and are working to fix it.
The fact that the vulnerability was not discovered until now means that it could have been exploited for a long time, potentially leading to significant data loss or other security issues. Additionally, the fact that the second issue fixed in the release, CVE-2026-19650, requires user interaction to work means that users may have been vulnerable to this issue as well.
