GITLAB released patches for two critical vulnerabilities on Monday. The first, CVE-2026-19478, is a severe code injection flaw with a CVSS score of 9.4, allowing unauthorized modification or deletion of user data through a GraphQL directive. The second vulnerability, CVE-2026-19650, is a CSRF issue (CVSS score 7.1) that could permit unauthenticated users to execute mutations due to improper request validation.
Both defects affect GitLab Community and Enterprise Editions from versions 18.2 onwards and were addressed in several updated versions. Users of self-managed installations are strongly advised to upgrade immediately, while no action is needed from GitLab.com users, as the patches were automatically applied. These vulnerabilities were reported through GitLab's HackerOne bug bounty program, with no evidence of exploitation in the wild.