🔴 Critical: Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
-
GitLab shipped security updates this week to close off a critical vulnerability in both its Community Edition (CE) and Enterprise Edition (EE) offerings. Under specific configurations, the flaw could allow an unauthenticated attacker to remotely alter or delete public projects and associated user data.
The issue, tracked as CVE-2026-19478, carries a CVSS score of 9.4 and has been rated Critical by GitLab. The root cause resides in the GraphQL API, where improper authorization checks open the door for exploitation.
- Affected versions include all releases of GitLab CE/EE prior to the latest patched versions.
- Upgrading to the newest security release is strongly recommended to mitigate the risk.
- Administrators should review their instance logs for any unauthorized GraphQL queries targeting public projects.
- If an upgrade cannot be performed immediately, restricting network access to the GitLab instance is advised as a temporary control.
Given the severity score and the fact that authentication is not required to trigger the issue, this patch should be treated as urgent. Public-facing instances are particularly exposed, and the window for attackers to exploit the flaw before widespread adoption of the update is likely narrow.
Source: The Hacker News
Has your team already patched your GitLab instance, or are you still assessing exposure to this GraphQL flaw?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login