Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication.

The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” the company said.

“GitLab.com and GitLab Dedicated are already running the patched version. GitLab.com and GitLab Dedicated customers do not need to take action,” they added.

The more severe vulnerability, CVE-2026-19478 (CVSS 9.4), involves code injection through a GraphQL directive and can be exploited remotely by an unauthenticated attacker without user interaction. Successful exploitation could allow an attacker to modify or delete public projects and user data.

The second vulnerability, CVE-2026-19650 (CVSS 7.1), is a cross-site request forgery issue in the GraphQL multiplex query handler. Improper request validation could allow an unauthenticated attacker to “execute mutations via GET requests,” though exploitation requires user interaction.

“We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards,” the company concluded.

Both vulnerabilities were reported through GitLab’s HackerOne bug bounty program.