Critical GitLab GraphQL Vulnerability Allow Attackers to Delete Public Projects

Cybersecuritynews •Abinaya • August 18, 2026

GitLab has released urgent security updates to fix a critical GraphQL vulnerability that could allow unauthenticated attackers to modify or delete public projects and user data remotely. The issue, tracked as CVE-2026-19478, affects GitLab Community Edition and Enterprise Edition installations across several supported release branches. The vulnerability was addressed in GitLab versions 19.2.4, 19.1.6, 19.0.8, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical GitLab Vulnerability Allows Unauthenticated Data Deletion GitLab released an emergency patch on August 17, 2026, for a critical vulnerability tracked as CVE-2026-19478. This flaw allows unauthenticated attackers to remotely modify or delete public projects and user data through a GraphQL directive, with a CVSS score of 9.4. Affected versions include GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.2 to 19.2.4. Organizations using self-managed instances are urged to upgrade immediately, while GitLab.com and GitLab Dedicated are already patched. The vulnerability was reported via the HackerOne bug bounty program, and no public proof-of-concept code has been observed yet. A second vulnerability, CVE-2026-19650, a CSRF issue, was also patched in the same release. The lack of technical details may hinder detection of exploitation attempts. 23 sources 72

Extracted Entities

Critical GitLab GraphQL Vulnerability Allow Attackers to Delete Public Projects

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)