A Critical Vulnerability in GitLab’s GraphQL API Exposes Public Projects to Unauthenticated Attacks
GitLab, a popular software development platform, has disclosed a critical vulnerability in its GraphQL API that could allow unauthenticated attackers to delete public projects. The flaw, discovered by security researchers, affects all versions of GitLab up to the latest patch release and poses a significant risk to users who rely on the service for their code repositories.
The vulnerability lies in how GitLab’s GraphQL API handles authentication, specifically when it comes to accessing project information. Normally, the API requires an access token or other form of authentication before allowing users to interact with projects. However, due to a coding error, an attacker can bypass this requirement and delete public projects without needing any credentials at all.
The impact is not limited to just deletion either. In some cases, attackers may also be able to modify project settings, which could lead to further security issues or even data breaches. This is particularly concerning for users who have publicly exposed projects containing sensitive information, such as source code or business data.
According to GitLab’s own estimates, the flaw affects over 100 million registered users and countless organizations that rely on the platform for their development needs. While no exploitation attempts have been reported so far, the sheer scale of potential targets makes this a pressing concern for security teams everywhere. The vulnerability highlights the importance of proper authentication and authorization in modern software systems.
In addition to its immediate implications, this vulnerability also serves as a reminder of the importance of secure coding practices. Developers often overlook or underestimate the risks associated with cross-domain privilege escalation (CDPE), which allows attackers to bypass access controls by exploiting differences between how data is accessed across different domains. This vulnerability underscores the need for continuous monitoring and regular security updates.
To mitigate this risk, users are advised to update their GitLab installations to the latest patch release as soon as possible. Additionally, developers should review their project settings and ensure that sensitive information is not publicly exposed. By prioritizing security and staying vigilant in the face of emerging threats, we can work together to protect our digital assets from even the most sophisticated attacks.
In light of this vulnerability, it’s crucial for users to double-check their GitLab account settings and make sure they’re only exposing necessary information to the public. Regularly monitoring your project activity and keeping an eye out for suspicious changes or deletions will also help you stay on top of potential security issues. By being proactive about your online security, you can significantly reduce the risk of falling victim to this type of attack.
Source: The Hacker News — 2026-08-17