Back Feeds2.Feedburner

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

Feeds2.Feedburner •Sinisa Markovic • August 18, 2026

GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. “These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical GitLab Vulnerability Allows Unauthenticated Data Deletion GitLab released an emergency patch on August 17, 2026, for a critical vulnerability tracked as CVE-2026-19478. This flaw allows unauthenticated attackers to remotely modify or delete public projects and user data through a GraphQL directive, with a CVSS score of 9.4. Affected versions include GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.2 to 19.2.4. Organizations using self-managed instances are urged to upgrade immediately, while GitLab.com and GitLab Dedicated are already patched. The vulnerability was reported via the HackerOne bug bounty program, and no public proof-of-concept code has been observed yet. A second vulnerability, CVE-2026-19650, a CSRF issue, was also patched in the same release. The lack of technical details may hinder detection of exploitation attempts. 30 sources 72

Extracted Entities

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (3)