GitLab has issued patches for two critical vulnerabilities that can be exploited without authentication, allowing attackers to manipulate user data and public projects. The company’s Community Edition (CE) and Enterprise Edition (EE) users from version 18.2 onwards are impacted.
The first vulnerability, tracked as CVE-2026-19478 with a CVSS score of 9.4, allows an unauthenticated attacker to modify or delete user data and public projects via a GraphQL directive. GitLab explains that this is due to improper request validation in GraphQL multiplex query handling. The company’s advisory states that “under certain conditions, an unauthenticated user could execute mutations via GET requests” due to the vulnerability.
The second bug, CVE-2026-19650 with a CVSS score of 7.1, is a cross-site request forgery (CSRF) issue affecting the GraphQL multiplex query handler. GitLab’s advisory notes that this flaw allows an attacker to execute unauthorized actions on behalf of a user without their consent.
The patches were automatically applied to GitLab.com and GitLab Dedicated, but users with self-managed installations are advised to upgrade immediately. Versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4 address both vulnerabilities. The company emphasizes that all self-managed installations should be upgraded promptly.
It’s worth noting that both security defects were reported through GitLab’s HackerOne bug bounty program. While the company has not mentioned any exploitation of these vulnerabilities in the wild, it’s essential for users to take immediate action and upgrade their versions. This highlights the importance of regular security updates and patching to prevent potential attacks.
The patches demonstrate GitLab’s commitment to addressing critical vulnerabilities promptly. The fact that both issues were reported through its bug bounty program underscores the value of such programs in identifying and resolving potential security threats before they can be exploited by attackers.
In conclusion, users should prioritize upgrading their self-managed installations as soon as possible to mitigate these risks. Regularly checking for updates and applying patches is crucial in maintaining the security of sensitive data and preventing potential attacks.
Source: SecurityWeek — 2026-08-18