# GitLab GraphQL Flaw CVE-2026-19478: Unauthenticated Project Deletion

> GitLab addresses a critical GraphQL flaw (CVE-2026-19478) allowing unauthenticated attackers to delete public projects and user data on self-managed CE/EE instances.

- Published: 2026-08-18T00:39:43.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Unauthenticated Access, CVE-2026-19478, CVE-2026-19650, GitLab, GraphQL
- CVEs: CVE-2026-19478 (CVSS 9.4), CVE-2026-19650 (CVSS 7.1)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html
- Canonical: https://runtimerebel.com/blog/gitlab-graphql-flaw-cve-2026-19478-unauthenticated-project-deletion

## Key points

- Unauthenticated attackers can remotely modify or delete public projects and user data on self-managed GitLab instances.
- Affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.11.x, 19.0.x, 19.1.x, and 19.2.x.
- Immediate patching to GitLab 19.2.4, 19.1.6, 19.0.8, or 18.11.11 is required for self-managed deployments.

## Critical GitLab GraphQL [Vulnerability](/glossary#vulnerability) Uncovered

GitLab has released urgent security updates to address a critical vulnerability, [CVE-2026-19478](https://nvd.nist.gov/vuln/detail/CVE-2026-19478), impacting its Community Edition (CE) and Enterprise Edition (EE) software. This flaw, rated with a [CVSS](/glossary#cvss) score of 9.4, could allow an unauthenticated attacker to remotely modify or delete public projects and user data under specific conditions. This disclosure, made outside GitLab's regular [patch](/glossary#patch) schedule, underscores the severity of the issue, particularly for self-managed installations, as detailed by [The Hacker News](https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html).

### Technical Details of GitLab [CVE](/glossary#cve)-2026-19478 Unauthenticated Project Deletion

The primary vulnerability, [CVE-2026-19478](https://nvd.nist.gov/vuln/detail/CVE-2026-19478), stems from an issue within a GraphQL directive. It allows an attacker to interact with a vulnerable GitLab instance over a network without requiring any authentication or user interaction. This provides a clear path for remote attackers to compromise the integrity and availability of public project data. While GitLab itself rated this flaw as Critical, the advisory confirms that no in-the-wild exploitation or public [exploit](/glossary#exploit) code has surfaced as of August 18, 2026.

In addition to the critical flaw, the security release also addresses [CVE-2026-19650](https://nvd.nist.gov/vuln/detail/CVE-2026-19650), a high-severity [cross-site request forgery (CSRF)](/glossary#cross-site-request-forgery-csrf) vulnerability in the GraphQL multiplex query handler. Rated with a CVSS score of 7.1, this issue could enable an unauthenticated user to execute GraphQL mutations via GET requests due to improper request validation. Unlike the critical flaw, exploiting CVE-2026-19650 typically requires user interaction.

### Affected Versions and Remediation Status

These vulnerabilities affect various versions of GitLab's self-managed Community Edition and Enterprise Edition. The necessary fixes are available in specific patch versions:

*   GitLab 19.2.4
*   GitLab 19.1.6
*   GitLab 19.0.8
*   GitLab 18.11.11

It is important to note that GitLab.com and GitLab Dedicated cloud services are already running the patched versions, meaning their customers do not need to take any action. However, self-managed installations on affected branches must apply these updates. Notably, the fixes do not extend to older branches, specifically 18.2 through 18.10, even though these versions fall within the affected range. Organizations running these unsupported versions are at particular risk and should plan for an upgrade to a supported, patched version immediately.

### Why These GitLab GraphQL Vulnerabilities Matter to Defenders

The potential for unauthenticated remote data modification and deletion posed by [CVE-2026-19478](https://nvd.nist.gov/vuln/detail/CVE-2026-19478) represents a significant threat to the integrity and availability of public projects hosted on self-managed GitLab instances. For organizations leveraging GitLab for collaborative development, the compromise of project data could lead to severe disruptions, reputational damage, and potential loss of intellectual property. Even without confirmed exploitation in the wild, the ease of exploitation (no authentication, no user interaction) makes this a high-priority vulnerability. The details of these flaws are expected to be made public by GitLab around mid-November 2026, 90 days after the patch release, which will likely increase the risk of targeted exploitation attempts as more information becomes available.

### Actionable Recommendations: How to Patch GitLab Self-Managed Instances

Security teams managing self-hosted GitLab CE/EE environments should prioritize the following actions to mitigate these vulnerabilities:

*   **Immediate Patching:** Upgrade all self-managed GitLab installations to the latest patched versions: 19.2.4, 19.1.6, 19.0.8, or 18.11.11. This is the single most effective step to address both [CVE-2026-19478](https://nvd.nist.gov/vuln/detail/CVE-2026-19478) and [CVE-2026-19650](https://nvd.nist.gov/vuln/detail/CVE-2026-19650).
*   **Version Review:** Identify any instances running on older, unsupported branches (18.2 through 18.10) that do not receive these specific fixes. These systems must be upgraded to a currently supported and patched release.
*   **Monitor [Threat Intelligence](/glossary#threat-intelligence):** Stay vigilant for any new developments, including the release of proof-of-concept (PoC) exploit code or reports of in-the-wild exploitation. The public disclosure of technical details in November 2026 will be a critical juncture.
*   **GraphQL Security Best Practices:** Beyond patching, review and strengthen overall GraphQL [API](/glossary#api) security configurations, including access controls, input validation, and rate limiting, to limit the potential impact of future GraphQL-related vulnerabilities. This proactive approach is essential for mitigating GitLab GraphQL vulnerabilities.

Adhering to these recommendations will significantly reduce the [attack surface](/glossary#attack-surface) and protect GitLab deployments from these serious security flaws.

**Related:** [GitLab 18.11.3 RCE via Jupyter Notebook Diff — Mitigation Guide](/blog/gitlab-18-11-3-rce-via-jupyter-notebook-diff-mitigation-guide), [ServiceNow Data Exposure via Unauthenticated API Flaw](/blog/servicenow-data-exposure-via-unauthenticated-api-flaw)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/gitlab-graphql-flaw-cve-2026-19478-unauthenticated-project-deletion