GitLab Patches Critical GraphQL Vulnerability That Could Enable Unauthenticated Project Deletion

GitLab has issued an out-of-band security update for a critical vulnerability in its Community Edition (CE) and Enterprise Edition (EE) products. Under certain conditions, the flaw could allow an unauthenticated remote attacker to modify or delete public projects and user data.

Tracked as CVE-2026-19478, the issue carries a CVSS score of 9.4. GitLab said the vulnerability involves a GraphQL directive, but has not disclosed the directive’s name or the specific circumstances required for exploitation. The published scoring indicates that the attack can be launched remotely without credentials, user interaction, or other prerequisites listed in the vector.

Affected versions and available fixes

The vulnerability affects self-managed GitLab installations running:

• 18.2 through versions before 18.11.11
• 19.0 through versions before 19.0.8
• 19.1 through versions before 19.1.6
• 19.2 through versions before 19.2.4

GitLab addressed the issue in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Organizations on the 18.2–18.10 branches will need to move to a supported fixed release because those branches did not receive separate patches. GitLab.com and GitLab Dedicated customers do not need to take action, as the hosted services have already been updated.

A second vulnerability, CVE-2026-19650, was also resolved. Rated High with a CVSS score of 7.1, it involves cross-site request forgery in GraphQL multiplex query processing. Improper request validation could have enabled an unauthenticated party to trigger mutations through GET requests, although exploitation requires user interaction.

GitLab said the release introduces no database migrations and should not require downtime for multi-node deployments. The company has not reported exploitation of either vulnerability, and no public proof-of-concept code was identified at the time of reporting. GitLab plans to publish additional technical details on its issue tracker approximately 90 days after the fixes became available, placing disclosure around mid-November 2026.