Code injection affecting GitLab CE/EE
A critical vulnerability was discovered in GitLab CE/EE, allowing an unauthenticated attacker to modify or delete public projects or user data on affected systems.
Description
Technical context and vulnerability details
GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These two products are affected by a vulnerability, labeled CVE-2026-19478, allowing an unauthenticated malicious actor to remotely perform critical modification and deletion operations on public projects and user data via a GraphQL directive. This vulnerability is classified critical, with a severity score of 9.4 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Breach of data availability;
- Data integrity breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- Version 18.2, versions prior to 18.11.11;
- Version 19.0, versions prior to 19.0.8;
- Version 19.1, versions earlier than 19.1.6;
- Version 19.2, versions prior to 19.2.4;
RECOMMENDED ACTIONS:
- Update GitLab CE/EE to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.