Vulnerability intelligence
CVE-2026-19478
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
CVSS Score
9.4
Critical
EPSS — Exploit Probability
60%
Riskier than 99% of all CVEs · checked 2026-09-29
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
8 articles across 5 outlets · first covered Aug 18, 2026 · latest Aug 23, 2026
Coverage timeline
-
GitLab fixes CVE-2026-19478 flaw allowing attacker deletionsecurityonline.info · Aug 23, 2026
-
GitLab GraphQL Vulnerability CVE-2026-19478 Actively Exploitedsecurityaffairs.com · Aug 21, 2026
-
Attackers hit GitLab flaw CVE-2026-19478 hours after disclosurethehackernews.com · Aug 21, 2026
-
GitLab Flaw CVE-2026-19478 Exploited in Days, Urges Patchwww.securityweek.com · Aug 20, 2026
-
GitLab flaw (CVE-2026-19478) lets attackers delete projectswww.darkreading.com · Aug 18, 2026
-
GitLab Patches Critical Unauthenticated GraphQL Vulnerabilitysecurityaffairs.com · Aug 18, 2026
-
GitLab fixes critical code injection and CSRF bugswww.securityweek.com · Aug 18, 2026
-
GitLab fixes CVE-2026-19478 GraphQL injection and CSRF flawsecurityonline.info · Aug 18, 2026