Critical GitLab GraphQL Flaw Exposes Public Projects to Deletion by Unauthenticated Attackers
A serious vulnerability in the GitLab platform’s GraphQL API has been discovered, allowing unauthenticated attackers to delete public projects. The flaw affects all GitLab instances that have the GraphQL feature enabled, making it a widespread issue that requires immediate attention from users and administrators.
The vulnerability works by exploiting a misconfigured permission check on the GraphQL API, which allows an attacker to execute the “DeleteProject” mutation without needing any authentication credentials. This means that even users who don’t have access to the project can delete it, as long as they know its ID. The attack is particularly concerning because public projects are often used for open-source development and collaboration, where anyone can view and contribute to the code.
GitLab’s GraphQL API is a feature that allows developers to interact with the platform using a query language similar to SQL. While this provides a flexible way to access data and perform actions on GitLab resources, it also introduces new security risks if not properly configured. In this case, the vulnerability highlights the importance of ensuring that permission checks are in place to prevent unauthorized changes to projects.
The impact of this flaw is significant, as any public project can be deleted by an attacker without warning or notification to the project owner. This could lead to loss of data, disruption of development workflows, and potential damage to a project’s reputation. Furthermore, the fact that no authentication is required makes it easier for attackers to carry out these attacks, potentially leading to more widespread consequences.
The discovery of this vulnerability underscores the importance of regular security audits and testing on platforms like GitLab. Administrators should ensure that their GraphQL API is properly configured, with adequate permission checks in place to prevent similar flaws from being exploited. Users are advised to review their project settings and consider implementing additional security measures to protect against potential attacks.
For users who rely on public projects for collaboration or open-source development, this vulnerability serves as a reminder of the importance of maintaining secure practices when contributing to external repositories. While the risk of deletion is low, it’s essential to be aware of the potential consequences and take steps to mitigate them. By staying vigilant and ensuring that all platform features are properly configured, we can minimize the impact of such vulnerabilities and maintain a safe online environment for developers and users alike.
Source: The Hacker News — 2026-08-17