GitLab has issued a critical security update to address a severe vulnerability in its Community Edition (CE) and Enterprise Edition (EE) software. This flaw, identified as CVE-2026-19478, could enable unauthenticated attackers to remotely modify or delete public projects and user data under specific conditions.
The vulnerability carries a CVSS score of 9.4, indicating its high severity. GitLab released the patch on August 17, 2026, outside its regular bi-monthly update schedule, underscoring the urgency of the issue. The affected versions include all releases from 18.2 up to 18.11.10, as well as 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Users are urged to upgrade to versions 18.11.11, 19.0.8, 19.1.6, or 19.2.4 to mitigate the risk.
GitLab.com and GitLab Dedicated instances have already been updated to the patched versions, so users of these services do not need to take further action. However, self-managed installations must apply the updates promptly to secure their environments.
In addition to CVE-2026-19478, GitLab addressed another vulnerability, CVE-2026-19650, rated with a CVSS score of 7.1. This issue involves a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler, which could allow unauthenticated users to execute mutations via GET requests due to improper request validation. Unlike the critical flaw, exploiting this vulnerability requires user interaction.
These vulnerabilities highlight the importance of regular software updates and vigilant security practices. Organizations using GitLab should prioritize applying these patches to prevent potential exploitation. The rapid response from GitLab demonstrates a commitment to maintaining the security and integrity of its platform.
