GitLab recently addressed a critical vulnerability affecting its Community Edition (CE) and Enterprise Edition (EE) software, which could potentially allow unauthorized access to modify or delete public projects and user data.
The vulnerability, identified as CVE-2026-19478, has been classified as Critical by GitLab with a CVSS score of 9.4.
Released on August 17, 2026, the critical patch update was released outside of GitLab’s regular bi-monthly update schedule, following a routine patch release with no critical issues just five days prior.
Self-managed installations are advised to take action, with fixes available in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
GitLab.com and GitLab Dedicated users are already running the patched version and are not required to take any additional action, according to the company.
The affected versions include:
- All versions from 18.2 to 18.11.11
- Versions 19.0 to 19.0.8
- Versions 19.1 to 19.1.6
- Versions 19.2 to 19.2.4
Notably, versions from 18.2 to 18.10 are within the affected range and are not covered by the fixes.
GitLab has addressed the issue that could potentially allow unauthorized users to manipulate or delete public projects and user data through a GraphQL directive under specific conditions, as stated by GitLab.
The flaw’s CVSS vector suggests that exploitation can occur over a network without credentials and without action from the victim.
Although no exploitation of the vulnerability has been reported, and no public exploit code is available on GitHub as of August 18, 2026.
The second issue, identified as CVE-2026-19650, is rated High by GitLab with a CVSS score of 7.1, addressing a cross-site request forgery (CSRF) vulnerability in the GraphQL multiplex query handler.
Unlike the critical flaw, this issue requires user interaction to be exploited.
GitLab has fixed the issue that could have allowed unauthorized users to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling, as confirmed by the company.
The update does not introduce new migrations and is not expected to cause downtime on multi-node deployments.
This disclosure follows a previous report in July 2026 where researchers published exploit code for a separate vulnerability affecting self-managed GitLab servers.
As of now, GitLab has not provided further comments on the matter, but the company typically makes vulnerability details public on its issue tracker 90 days after patch release, aligning with a 30-day window set in June 10, 2026, which suggests that technical details of these flaws may be disclosed around mid-November 2026.
