Unauthenticated GraphQL flaw lets attackers alter or delete GitLab projects (CVE-2026-19478)
VulnCheck added this flaw to its known-exploited catalog today with five public exploits already circulating, and self-managed GitLab instances left unpatched this week risk unauthenticated attackers tampering with or destroying their projects and user data.
A flaw in GitLab CE/EE GraphQL directive handling allows a completely unauthenticated remote attacker to modify or delete public projects and user data. Because tampered public repositories can poison everything downstream that pulls from them, the integrity impact extends well beyond the GitLab instance itself.
Affected: GitLab CE/EE >= 18.2 < 18.11.11; GitLab CE/EE >= 19.0 < 19.0.8; GitLab CE/EE >= 19.1 < 19.1.6; GitLab CE/EE >= 19.2 < 19.2.4
How to Test
Check your version via /help or `gitlab-rake gitlab:env:info` — anything from 18.2 up to but not including 18.11.11/19.0.8/19.1.6/19.2.4 is vulnerable. Review production_json.log and workhorse logs for unauthenticated POSTs to /api/graphql containing unusual or malformed directives, and audit recent project deletion/modification events (audit_events, project destroy jobs) that lack a corresponding authenticated actor.
How to Patch
Upgrade immediately to GitLab 18.11.11, 19.0.8, 19.1.6, or 19.2.4 per the GitLab 19.2.4 patch release notes. If you cannot upgrade today, restrict unauthenticated network access to /api/graphql at your reverse proxy or firewall until you can, and take fresh backups of repositories and the database first.