GitLab patches critical flaw risking public project deletion

GitLab on Monday released critical security patches to address two vulnerabilities, including a severe flaw that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The company urged immediate upgrades for all self-managed installations of its software.

The most serious vulnerability, tracked as CVE-2026-19478 and assigned a CVSS score of 9.4, is a code injection issue involving a GraphQL directive. It affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 prior to 18.11.11, 19.0 prior to 19.0.8, 19.1 prior to 19.1.6, and 19.2 prior to 19.2.4. GitLab stated the flaw could be exploited remotely without user interaction. A successful attack could allow an unauthenticated user to perform unauthorized actions against public GitLab resources, potentially resulting in data or project modification or deletion.

The second vulnerability, CVE-2026-19650, is a high-severity (CVSS 7.1) cross-site request forgery issue in the GraphQL multiplex query handler. Exploitation requires user interaction but could, under improper request validation, allow an unauthenticated attacker to execute mutations via GET requests.