Dev · Security
Critical GitLab Flaw Lets Attackers Delete Projects
GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects and user data via the GraphQL API.
Fixed versions are 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Self-hosted administrators should update immediately.
GitLab has closed two security vulnerabilities affecting both the Community Edition and the Enterprise Edition. The fixed releases are 18.11.11, 19.0.8, 19.1.6 and 19.2.4. GitLab.com already runs the patched versions, but administrators of self-hosted installations are urged to act quickly.
The more severe flaw, CVE-2026-19478, is rated critical. It sits in the GraphQL API of a GitLab instance. An attacker with access to the API can send crafted GraphQL requests to alter or delete public projects and user data.
The second vulnerability, CVE-2026-19650, is rated high and requires user interaction. A victim must click a manipulated link, after which an attacker can issue GET requests against the GraphQL API and modify project settings. If the victim holds admin rights, an attacker could compromise the entire instance with those privileges.
GitLab reports no evidence of active exploitation so far, but strongly recommends prompt updates. Instances running versions that are no longer supported must first be upgraded to a supported release. GitLab last issued an urgent update recommendation at the end of July.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.