CVE-2026-19650
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Risk Assessment
The vulnerability allows an unauthenticated attacker to execute mutations, which could lead to unauthorized changes in data or GitLab configuration. However, it requires specific conditions.
Recommendation
It is recommended to upgrade GitLab to a patched version (18.11.11, 19.0.8, 19.1.6, or 19.2.4 depending on the version). Also, monitor logs for unusual GET requests.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.