CVE-2026-19478
CriticalCVSS 9.4Summary
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Risk Assessment
An unauthenticated attacker could modify or delete public projects and user data, potentially leading to data loss and integrity compromise.
Recommendation
Upgrade GitLab to version 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) depending on your release line.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.