Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
- ID
- 14990
- Status
- summarized
- Published
- 18 Aug 2026, 5:03 AM
- Fetched
- 18 Aug 2026, 5:13 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 18 Aug 2026, 5:16 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
GitLab issued an out-of-schedule critical patch on August 17, 2026 for CVE-2026-19478 (CVSS 9.4), which lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive on self-managed CE/EE installations. Affected versions span 18.2 through 19.2; fixes are in 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but versions 18.2–18.10 receive no patch. A second high-severity CSRF flaw (CVE-2026-19650, CVSS 7.1) in the GraphQL multiplex handler is also fixed in the same release.
Why it matters
If your team runs self-managed GitLab in the affected range, patch to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 immediately — unauthenticated remote deletion of public projects requires no victim interaction. Teams on versions 18.2–18.10 have no fix available and must upgrade to at least 18.11.11. GitLab.com and GitLab Dedicated users are already patched and need no action.
Discussion angle
How many Malaysian dev teams still run self-managed GitLab on older versions, and what's the upgrade path for those stuck on 18.2–18.10 with no available patch?