GitLab has issued crucial updates addressing two significant vulnerabilities, including a severe code injection risk that could be exploited without user authentication. The security issue, identified as CVE-2026-19478 and carrying a CVSS score of 9.4, permits unauthorized modifications or deletions of user data and public projects via a GraphQL directive, according to GitLab’s advisory.
Details of the Vulnerabilities
The critical vulnerability CVE-2026-19478 allows attackers to manipulate user data without authentication, posing a substantial threat to data integrity. Another security flaw, CVE-2026-19650, which has a CVSS score of 7.1, involves a cross-site request forgery (CSRF) issue affecting the GraphQL multiplex query handler. This flaw could have enabled unauthorized execution of mutations via GET requests due to insufficient request validation.
Affected Versions and Patches
All versions of GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.2, 19.0, 19.1, and 19.2 onwards are susceptible to these vulnerabilities. GitLab has addressed these issues in the latest updates: versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Users of self-managed installations are urged to update to these versions promptly to mitigate potential risks.
Automatic Updates and Security Reporting
The patches have been automatically deployed to GitLab.com and GitLab Dedicated, requiring no further action from their users. Both security issues were reported through GitLab’s HackerOne bug bounty program, underlining the importance of community-driven security efforts. There are currently no reports of these vulnerabilities being actively exploited in the wild.
These updates emphasize the need for timely software maintenance to safeguard against emerging threats. For users and organizations relying on GitLab for code management and collaboration, staying updated with the latest security patches is crucial to maintaining data security and system integrity.
