Ethical Hacking News
A critical vulnerability has been discovered in GitLab's GraphQL flaw, allowing unauthenticated attackers to remotely modify or delete public projects and user data. The vulnerability has been rated as 9.4 on the CVSS scale and has been fixed in the latest version of the software.
GitLab has disclosed a critical vulnerability (CVE-2026-19478) that allows unauthenticated attackers to remotely modify or delete public projects and user data. The vulnerability has a severity rating of 9.4 on the Common Vulnerability Scoring System (CVSS) scale. GitLab has released security updates to address the vulnerability, which is available in version 19.2.4, 19.1.6, 19.0.8, and 18.11.11. The critical vulnerability can be exploited via GET requests, without user interaction. GitLab recommends only self-managed installations take action, as the fixes are already available in the latest version of the software. The fixes do not extend to the 18.2 through 18.10 branches. A high-severity vulnerability (CVE-2026-19650) concerning a cross-site request forgery (CSRF) weakness has also been fixed.
GitLab, a prominent web-based platform for software development and collaboration, has recently disclosed a critical vulnerability in its GraphQL flaw that could allow unauthenticated attackers to remotely modify or delete public projects and user data. This critical vulnerability has been rated as 9.4 on the Common Vulnerability Scoring System (CVSS) scale, indicating a high level of severity.
According to the announcement made by GitLab, the critical vulnerability, tracked as CVE-2026-19478, was discovered and reported by researchers who published working exploit code for a separate GitLab flaw affecting self-managed servers. The company has released security updates to address this critical vulnerability, which is available in the latest version of GitLab, 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
The critical vulnerability in question is a result of an improper request validation in the GraphQL multiplex query handler, which allows an attacker to execute mutations via GET requests. This vulnerability does not require user interaction to exploit, making it a serious threat to the security of the platform. The disclosure of this vulnerability follows a recent report by researchers that exposed a similar vulnerability in a separate GitLab flaw, which highlights the importance of vulnerability disclosure and the need for companies to regularly update and patch their software.
GitLab's security team has stated that only self-managed installations need to act, as the fixes are already available in the latest version of the software. The company has also assured customers that GitLab.com and GitLab Dedicated customers do not need to take any action, as the patched version of the software is already running.
The affected versions of GitLab include all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. The fixes for this vulnerability do not extend to the 18.2 through 18.10 branches, which fall inside the affected range.
In addition to the critical vulnerability, GitLab has also fixed a high-severity vulnerability, tracked as CVE-2026-19650, which concerns a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler. This vulnerability requires user interaction to exploit, making it less severe than the critical vulnerability.
The disclosure of this critical vulnerability highlights the importance of regular software updates and patching, as well as the need for companies to take vulnerability disclosure seriously. It also serves as a reminder to developers and users of the importance of ensuring that their software is properly secured against unauthorized access and modification.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Vulnerability-Exposed-in-GitLabs-GraphQL-Flaw-ehn.shtml
https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-19478
https://www.cvedetails.com/cve/CVE-2026-19478/
https://nvd.nist.gov/vuln/detail/CVE-2026-19650
https://www.cvedetails.com/cve/CVE-2026-19650/
Published: Mon Aug 17 17:07:31 2026 by llama3.2 3B Q4_K_M
