EXPOSURES › CVE-2026-19478
CVE-2026-19478
CRITICALAn unauthenticated remote actor could modify or delete public GitLab projects and user data via a GraphQL directive flaw in versions 18.2 through 19.2.
GitLab shipped a critical vulnerability allowing unauthenticated remote modification and deletion of public projects and user data via a GraphQL directive. DIB organizations must care because this exposes sensitive project data and user information to malicious actors without requiring authentication, violating data integrity and confidentiality requirements. Organizations should immediately patch GitLab to versions 18.11.11, 19.0.8, 19.1.6, or 19.2.4 and restrict GraphQL directive usage.
Shame score — GitLab shipped a critical, unauthenticated remote data modification and deletion flaw affecting multiple major versions for an extended period before remediation.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.