GitLab Critical Flaw Allows Unauthenticated Project Deletion

GitLab has shipped an out-of-band security update to address a critical vulnerability that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, which carries a CVSS score of 9.4, affects both Community Edition and Enterprise Edition installations.

Critical Flaw, High CVSS

The vulnerability, tracked as CVE-2026-19478, is rated Critical by GitLab. Its CVSS vector indicates the flaw can be exploited over the network by an attacker with no credentials, and without any victim interaction. This makes it a particularly dangerous issue for self-managed GitLab instances.

Out-of-Band Patch Release

The critical patch release arrived on August 17, 2026, breaking GitLab's usual cadence of updates on the second and fourth Wednesdays of each month. This release came just five days after a routine patch that contained no critical-rated issues. The urgency suggests the company sought to address the vulnerability as quickly as possible.

Affected Versions and Fixes

Only self-managed installations need to take action. The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. GitLab.com and GitLab Dedicated are already running the patched version.

The following versions are affected:

• All versions from 18.2 before 18.11.11
• 19.0 before 19.0.8
• 19.1 before 19.1.6
• 19.2 before 19.2.4

Notably, the fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range. Administrators on those versions will need to upgrade to a patched release to secure their instances.

Root Cause and Impact

GitLab has not disclosed the specific GraphQL directive involved or the exact conditions required for exploitation. The advisory states: "GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive."

According to the advisory, there is no evidence of exploitation, and no public exploit code has surfaced on GitHub as of August 18, 2026. Still, the potential impact is severe: an attacker could delete public projects and associated user data without any authentication.

Second High-Severity Issue

Alongside the critical flaw, the release also patches a High-severity issue, CVE-2026-19650, with a CVSS score of 7.1. This vulnerability is a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler. Unlike the critical flaw, it requires user interaction to exploit.

GitLab explained: "GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling."

Upgrade Considerations

GitLab says the update introduces no new migrations and is not expected to require downtime on multi-node deployments. This makes the upgrade process less disruptive for large, distributed installations.

Context and Disclosure Timeline

The disclosure follows a July 2026 report in which researchers published working exploit code for a separate GitLab flaw affecting self-managed servers. GitLab did not immediately respond to a request for comment.

The company said it makes the issues detailing each vulnerability public on its issue tracker 90 days after the release that patched them. However, GitLab's June 10, 2026 patch release put that window at 30 days. That places technical details of both flaws at around mid-November 2026.

Why It Matters

Self-managed GitLab administrators should treat this as a priority upgrade. The critical flaw's ability to be exploited remotely without authentication, combined with the lack of any required user interaction, makes it a serious risk for organizations that rely on GitLab for their development workflows. While no active exploitation has been reported yet, the technical details are expected to be made public in a few months, which could widen the attack surface as attackers reverse-engineer the patch.