Back Securityaffairs.Co

GitLab Patches Critical Unauthenticated GraphQL Vulnerability

Securityaffairs.Co •Pierluigi Paganini • August 18, 2026

GitLab patched a critical GraphQL flaw that let unauthenticated attackers remotely modify or delete public projects on self-managed servers. GitLab pushed out an emergency patch this week to address a critical flaw, tracked as CVE-2026-19478 (CVSS score of 9.4), that could let an attacker with zero credentials remotely modify or delete public projects and user […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical GitLab Vulnerability Allows Unauthenticated Data Deletion GitLab released an emergency patch on August 17, 2026, for a critical vulnerability tracked as CVE-2026-19478. This flaw allows unauthenticated attackers to remotely modify or delete public projects and user data through a GraphQL directive, with a CVSS score of 9.4. Affected versions include GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.2 to 19.2.4. Organizations using self-managed instances are urged to upgrade immediately, while GitLab.com and GitLab Dedicated are already patched. The vulnerability was reported via the HackerOne bug bounty program, and no public proof-of-concept code has been observed yet. A second vulnerability, CVE-2026-19650, a CSRF issue, was also patched in the same release. The lack of technical details may hinder detection of exploitation attempts. 23 sources 72

Extracted Entities

Attack Types (1)

Data Breach

CVEs (1)

CVE-2026-19478