GitLab has released urgent security updates for CE and EE to fix CVE-2026-19478, a critical flaw that could let an unauthenticated attacker remotely modify or delete public projects and user data in self-managed installations. The release also patches CVE-2026-19650, a high-severity CSRF issue in GraphQL multiplex query handling, with fixes available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. #GitLab #CVE-2026-19478 #CVE-2026-19650 #GraphQL
Keypoints
- GitLab fixed a critical vulnerability in Community Edition and Enterprise Edition.
- CVE-2026-19478 could allow unauthenticated remote modification or deletion of public projects and user data.
- The critical issue affects self-managed installations and is patched in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
- GitLab also addressed CVE-2026-19650, a high-severity CSRF flaw in GraphQL multiplex query handling.
- GitLab.com and GitLab Dedicated are already patched and do not require customer action.
Read More: https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html