GITLAB has addressed a critical vulnerability, CVE-2026-19478, allowing unauthenticated attackers to delete public projects and user data. This flaw has a CVSS score of 9.4 and has been actively exploited in the wild, with proof-of-concept (PoC) code available publicly. Attackers can modify or delete data without user interaction, posing severe risks to software supply chains. Users are advised to update their GitLab installations to the patched versions (18.11.11, 19.0.8, 19.1.6, 19.2.4) immediately.
The vulnerability stems from a bug in GitLab's GraphQL directive that mismanages unverified fields, allowing dangerous methods to be invoked.