Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software.
A critical vulnerability has been discovered in GitLab's Community Edition (CE) and Enterprise Edition (EE) software, allowing an unauthenticated attacker to remotely modify or delete public projects and user data.
The flaw, tracked as **CVE-2026-19478**, has been rated Critical by GitLab and assigned a CVSS score of 9.4. This means that an attacker with no credentials can exploit the vulnerability over a network, without any action on the part of a victim.
Only self-managed installations need to act, as the fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. GitLab.com and GitLab Dedicated are already running the patched version, and their customers do not need to take action.
The following versions are affected:
| Version Range | Affected Versions | | --- | --- | | 18.2 before 18.11.11 | All versions from 18.2 before 18.11.11 | | 19.0 before 19.0.8 | 19.0 before 19.0.8 | | 19.1 before 19.1.6 | 19.1 before 19.1.6 | | 19.2 before 19.2.4 | 19.2 before 19.2.4 |
The fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range.
GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive. However, the company has not named the GraphQL directive involved or specified what the conditions necessary for exploitation are.
The advisory discloses no exploitation of either flaw, and no public exploit code for them has surfaced on GitHub as of August 18, 2026.
In addition to the critical flaw, the update also fixes a High-rated issue, **CVE-2026-19650**, which concerns a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler. This issue requires user interaction to work.
The company said the update introduces no new migrations and is not expected to require downtime on multi-node deployments.
The disclosure follows a July 2026 report in which researchers published working exploit code for a separate GitLab flaw affecting self-managed servers. GitLab did not immediately respond to a request for comment.
The company said it makes the issues detailing each vulnerability public on its issue tracker 90 days after the release that patched them. This means that technical details of both flaws will be made public around mid-November 2026.
