GitLab releases security updates to address a critical vulnerability that can, in certain conditions, allow an unauthenticated attacker to remotely modify or delete public projects and related user data. The issue is tracked as CVE-2026-19478 and is rated Critical by GitLab, with a CVSS score of 9.4.
The reports say the flaw impacts GitLab Community Edition (CE) and Enterprise Edition (EE) and is tied to GraphQL behavior that could be exploited without authentication when specific requirements are met. Help Net Security also states that the affected versions include GitLab 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. According to that source, GitLab provides fixes in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
Across outlets, the main emphasis is on GitLab’s patch release for CE and EE and the potential for remote data changes without authentication. Both sources describe the vulnerability’s impact in terms of public projects and user data, while providing consistent references to CVE-2026-19478 and GitLab’s critical severity rating.
