GitLab - Unauthenticated GraphQL Code Injection & CSRF (Public Project/Data Deletion)
GitLab is a web-based DevOps platform providing Git repository management, CI/CD pipelines, issue tracking, and project collaboration. The platform exposes a GraphQL API for programmatic access to core functionality. CVE-2026-19478 — Critical Code injection flaw in the GraphQL API of GitLab CE and EE, via a GraphQL directive. Under certain conditions, a remote unauthenticated attacker can modify or delete public projects and user data, with no authentication and no user interaction — hence the high severity and the risk of data loss and supply-chain compromise. It affects self-managed installations across several branches (18.2 through 18.11, 19.0, 19.1, 19.2). Fixed on August 17, 2026 in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, shipped as an ad hoc critical patch outside the normal cycle. GitLab.com and GitLab Dedicated already run the patched version and need no action. Worth noting: the fixes do not cover the 18.2 through 18.10 branches, which remain within the affected range — those installations must migrate to a patched branch. CVE-2026-19650 — High CSRF (cross-site request forgery) flaw in the GraphQL multiplex query handler. Improper request validation allows GraphQL mutations to be triggered via GET requests, even though these state-changing operations should not be reachable that way. Unlike the critical flaw, this one requires victim interaction: a targeted user must be lured into opening a specially crafted request, which narrows its scope — but it can still lead to unauthorized state-changing operations server-side. Fixed in the same versions (19.2.4, 19.1.6, 19.0.8, 18.11.11). Paths / attack surface: /api/graphql — the GraphQL API endpoint. Both flaws live here: the critical one via a crafted GraphQL directive, the CSRF one via the multiplex query handler accepting mutations over GET.
