The issue, tracked as CVE-2026-19478, carries a CVSS score of 9.4 and has been rated Critical by GitLab. The root cause resides in the GraphQL API, where improper authorization checks open the door for exploitation.

• Affected versions include all releases of GitLab CE/EE prior to the latest patched versions.
• Upgrading to the newest security release is strongly recommended to mitigate the risk.
• Administrators should review their instance logs for any unauthorized GraphQL queries targeting public projects.
• If an upgrade cannot be performed immediately, restricting network access to the GitLab instance is advised as a temporary control.

Given the severity score and the fact that authentication is not required to trigger the issue, this patch should be treated as urgent. Public-facing instances are particularly exposed, and the window for attackers to exploit the flaw before widespread adoption of the update is likely narrow.

Source: The Hacker News

Has your team already patched your GitLab instance, or are you still assessing exposure to this GraphQL flaw?