The Community Edition (CE) and Enterprise Edition (EE) of the source code management software GitLab had two dangerous security vulnerabilities, now fixed in the latest updates. One is critical and lets attackers modify or delete public projects and user data without any authentication at all. If you run a self-managed GitLab instance, you should update promptly.
Deletion without logging in
The critical flaw is registered as CVE-2026-19478 and carries a CVSS score of 9.4. According to the description, it lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL statement under certain, unspecified circumstances.
A second, high-severity flaw comes on top: CVE-2026-19650 (CVSS 7.1). According to GitLab, it lets unauthenticated attackers, also under certain circumstances, execute mutations via GET requests due to faulty request validation when processing GraphQL multiplexed queries.
Affected and patched versions
Both flaws affect the CE and EE variants of GitLab starting with versions 18.2, 19.0, 19.1, and 19.2. They've been patched in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. GitLab recommends installing the available updates on self-managed instances promptly to protect vulnerable systems from possible attacks. Update guidance is available on the vendor's website.
There are no signs of active exploitation so far. However, thanks to modern AI tools, the time between disclosure and exploitation of vulnerabilities keeps shrinking, so you shouldn't wait too long to apply the updates. If you use GitLab's services through gitlab.com or the GitLab Dedicated SaaS solution, you don't need to take any action. According to GitLab, those already run the patched versions, and the vendor itself is responsible for updating them.