GitLab has disclosed a critical security vulnerability known as CVE-2026-19478, affecting GitLab Community Edition and Enterprise Edition. This zero-click flaw allows remote attackers to manipulate or delete publicly accessible projects and user data without the need for authentication or credentials. The vulnerability exploits GitLab's GraphQL functionality, posing significant risks to data integrity and availability. The flaw, which has been given a CVSS score of 9.4, affects multiple versions of GitLab CE/EE ranging from 18.2 to 19.2. Organizations using GitLab's self-managed versions are advised to immediately upgrade to the newly released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
GitLab's decision to withhold technical details of the vulnerabilities for 90 days post-patch is in line with their policy, though it complicates the detection of exploits. Security teams are advised to focus on monitoring GitLab GraphQL, API, reverse-proxy, and audit logs for unusual activities, especially those involving unexplained project deletions or configuration changes. The out-of-band security update underscores the urgency and severity of the threat.
Additionally, another flaw identified as CVE-2026-19650, a cross-site request forgery issue, affects the same versions and carries a CVSS score of 7.1. For organizations unable to patch immediately, it is recommended to restrict unauthenticated external traffic and audit all public repositories to mitigate potential risks. The vulnerabilities highlight the challenges posed by GraphQL's single interface design, which can complicate defense efforts. Organizations must remain vigilant, looking for anomalies in GraphQL API logs and taking immediate action to secure their environments.