Full Report
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
Analysis Summary
# Vulnerability: Unauthenticated Remote Modification/Deletion in GitLab GraphQL
## CVE Details
- **CVE ID:** CVE-2026-19478
- **CVSS Score:** 9.4 (Critical)
- **CWE:** Not specifically listed (Related to improper authorization/access control in GraphQL directives)
## Affected Systems
- **Products:** GitLab Community Edition (CE) and Enterprise Edition (EE)
- **Versions:**
- All versions from 18.2 before 18.11.11
- 19.0 before 19.0.8
- 19.1 before 19.1.6
- 19.2 before 19.2.4
- **Configurations:** Self-managed installations are primarily at risk. GitLab.com and GitLab Dedicated have already been patched by the vendor.
## Vulnerability Description
This critical flaw exists within GitLab's GraphQL implementation. Under specific conditions, a "GraphQL directive" can be abused by an unauthenticated user to remotely modify or delete public projects and associated user data. The vendor has not yet disclosed the specific directive or the exact technical conditions required for exploitation to prevent immediate widespread abuse.
## Exploitation
- **Status:** Not currently exploited in the wild; no public PoC available as of August 18, 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Low/None (Primary focus is on modification/deletion)
- **Integrity:** High (Unauthorized modification of projects and user data)
- **Availability:** High (Unauthorized deletion of projects and user data)
## Remediation
### Patches
GitLab has released the following versions to address the vulnerability. Administrators should upgrade immediately:
- **19.2.4**
- **19.1.6**
- **19.0.8**
- **18.11.11**
*Note: Versions 18.2 through 18.10 are affected but do not have backported fixes; users on these branches must upgrade to 18.11.11 or higher.*
### Workarounds
No specific manual workarounds (such as disabling specific features) were provided in the advisory. Immediate patching is the recommended course of action.
## Detection
- **Indicators of Compromise:** Monitor web server logs and GraphQL API logs for unusual `POST` requests to `/api/graphql` originating from unauthenticated IP addresses, particularly those involving project deletion or modification mutations.
- **Detection Methods:** Security teams should audit public project integrity and check for unexpected deletions or permission changes in the GitLab audit events log.
## References
- **Vendor Advisory:** hxxps[://]docs[.]gitlab[.]com/releases/patches/patch-release-gitlab-19-2-4-released/
- **News Source:** hxxps[://]thehackernews[.]com/2026/08/critical-gitlab-graphql-flaw-could-let.html