Reported by 3 outlets

Timeline

1. update from cyberpress.org

   GitLab Critical Vulnerability Lets Unauthenticated Attackers Modify or Delete Projects

   cyberpress.org · 56d ago · August 18th, 2026

   GitLab has released emergency security updates after discovering a critical vulnerability that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, affects GitLab Community Edition and Enterprise Edition installations across multiple supported versions. Administrators operating self-managed GitLab servers are being urged to update immediately, particularly organizations with internet-facing instances , public repositories, or externally accessible GraphQL services. GitLab Critical Vulnerability GitLab Dedicated is already running the patched release, meaning customers using those hosted services do not need to take action. The company issued GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 on August 17, 2026. The releases were published as an ad hoc critical patch rather than part of GitLab’s normal twice-monthly security update schedule. CVE-2026-19478 is a code injection issue involving a GraphQL directive. Under certain conditions, the vulnerability could enable a remote, unauthenticated user to alter or delete public projects and user data. The issue received a CVSS severity score of 9.4 out of 10, reflecting its potential for high impact on integrity and availability without requiring credentials, victim interaction, or complex exploitation conditions. Affected installations include GitLab CE and EE versions from 18.2 through 18.11.11; GitLab 19.0 versions from 19.0.0 through 19.0.8; Gi

2. update from gbhackers.com

   GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update

   gbhackers.com · 56d ago · August 18th, 2026

   GitLab has released critical security updates for both the Community Edition (CE) and the Enterprise Edition (EE), addressing two GraphQL-related vulnerabilities that could expose self-managed instances to unauthorized project manipulation and request-forgery attacks. Administrators operating affected self-managed deployments are […] The post GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from socprime.com

   CVE-2026-19478: Critical GitLab GraphQL Flaw Enables Unauthenticated Data Modification

   socprime.com · 55d ago · August 19th, 2026

   According to GitLab’s CVSS assessment, exploitation can be performed remotely with low attack complexity, requires no privileges, and does not depend on any user interaction. These characteristics make vulnerable internet-facing self-managed GitLab instances particularly exposed to automated attacks once reliable exploitation techniques become available. GitLab.com and GitLab Dedicated were already running patched software, meaning the urgent remediation requirement applies primarily to organizations operating self-managed installations. CVE-2026-19478 analysis The vulnerability exists in GitLab’s GraphQL functionality and, under specific conditions, permits an unauthenticated attacker to inject operations through a GraphQL directive. Successful exploitation can result in unauthorized modification or deletion of publicly accessible projects and user data.