vulnerability
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Critical
Summary
GitLab has released a critical security update to address a vulnerability (CVE-2026-19478) that could allow unauthenticated attackers to delete public projects and user data. The flaw, which was discovered outside of GitLab's regular patching schedule, affects self-managed installations and requires immediate action. A secondary, high-severity vulnerability (CVE-2026-19650) related to CSRF in GraphQL multiplex query handling also exists, but requires user interaction to exploit.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data