Critical GitLab Flaw Allows Unauthenticated Deletion of Public Projects
A critical vulnerability in GitLab CE/EE, CVE-2026-19478, allows unauthenticated attackers to delete or modify public projects and user data, with a CVSS score of 9.4.
GitLab has issued urgent security updates to address a critical vulnerability, CVE-2026-19478, that could permit unauthenticated attackers to remotely alter or delete public projects and associated user data. The flaw impacts both GitLab Community Edition (CE) and Enterprise Edition (EE) software, and has been assigned a Critical severity rating with a CVSS score of 9.4.
The out-of-band patch, released on August 17, 2026, arrived unexpectedly outside of GitLab's regular twice-monthly update schedule. This critical fix was deployed just five days after a routine patch release that did not contain any high-severity issues.
This vulnerability affects only self-managed GitLab installations. Users are urged to update to the patched versions, which include GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. GitLab has confirmed that GitLab.com and GitLab Dedicated environments are already running the patched versions, and customers using these services do not need to take any action.
The affected versions range from all versions starting from 18.2 up to, but not including, 18.11.11; versions 19.0 before 19.0.8; 19.1 before 19.1.6; and 19.2 before 19.2.4. Notably, versions 18.2 through 18.10, which fall within the affected range, do not have specific fixes extended to them beyond the general update.
GitLab's advisory states that the vulnerability could allow an unauthenticated user to remotely modify or delete public projects and user data through a specific GraphQL directive. The CVSS vector indicates that exploitation is possible over a network without requiring any credentials or user interaction from the victim. However, GitLab has not yet disclosed the specific GraphQL directive involved or the precise conditions required for exploitation.
As of August 18, 2026, GitLab has not reported any instances of this vulnerability being exploited in the wild, nor has any public exploit code surfaced on platforms like GitHub. This provides a window for administrators to apply the necessary patches before potential exploitation.
Alongside the critical flaw, the security update also addresses CVE-2026-19650, a High-severity vulnerability with a CVSS score of 7.1. This issue involves a cross-site request forgery (CSRF) weakness within the GraphQL multiplex query handler, which requires user interaction to be exploited. GitLab has remediated an issue where improper request validation in GraphQL multiplex query handling could allow an unauthenticated user to execute mutations via GET requests.
The company has stated that this update introduces no new migrations and is not expected to cause downtime for multi-node deployments. This disclosure follows a previous report in July 2026 detailing working exploit code for a separate GitLab vulnerability affecting self-managed servers. GitLab typically makes vulnerability details public on its issue tracker 90 days after a patch is released, meaning technical details for these flaws are expected around mid-November 2026.