Critical GitLab Flaw Exposes Public Projects to Deletion
A newly patched GitLab vulnerability allows unauthenticated attackers to delete or modify public projects. Organizations using GitLab CE or EE should update immediately.
TL;DR
- GitLab released urgent patches for CVE-2026-19478, a critical GraphQL API flaw.
- The vulnerability allows remote deletion or modification of public projects without authentication.
- Affects both Community Edition (CE) and Enterprise Edition (EE) under specific configurations.
- CVSS score is 9.4, classified as critical by GitLab.
- Organizations should update their GitLab instances immediately to mitigate risk.
GitLab has addressed a severe security vulnerability that could allow unauthenticated attackers to delete or modify public projects hosted on affected servers. The issue, tracked as CVE-2026-19478, impacts both GitLab Community Edition and Enterprise Edition under certain configurations.
With a CVSS score of 9.4, this flaw represents a critical risk to organizations relying on GitLab for source code management. The vulnerability lies within the GraphQL API, which can be exploited remotely without requiring attacker authentication.
Vulnerability Details
- CVE-2026-19478 affects GitLab's GraphQL endpoint, enabling unauthorized destructive actions.
- Attackers can delete or modify public projects without needing credentials.
- The flaw requires specific configuration conditions to be exploitable.
- Both GitLab CE and EE versions are impacted if not updated.
Recommended Actions
- Immediately upgrade GitLab instances to the latest patched versions.
- Review project access logs for suspicious activity around GraphQL endpoints.
- Ensure all public projects have proper backup and recovery procedures in place.
- Monitor vendor advisories for any additional related vulnerabilities.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.