### Urgent Patch for Critical GitLab Flaw **GitLab** has released critical security updates to mitigate **CVE-2026-19478**, a vulnerability impacting its **Community Edition (CE)** and **Enterprise Edition (EE)** software. Rated with a **CVSS score of 9.4**, this flaw could allow an unauthenticated attacker to remotely modify or delete public projects and user data under specific conditions. Released on August 17, 2026, this critical patch arrived outside **GitLab's** usual twice-monthly update schedule, highlighting the severity of the issue. ### Affected Versions and Remediation Only self-managed **GitLab** installations are required to take action. The necessary fixes are available in **GitLab** versions **19.2.4, 19.1.6, 19.0.8, and 18.11.11**. **GitLab.com** and **GitLab Dedicated** platforms are already running the patched version, so customers using these services do not need to take any action. The following versions are affected: * All versions from 18.2 before 18.11.11 * 19.0 before 19.0.8 * 19.1 before 19.1.6 * 19.2 before 19.2.4 It's important to note that the fixes do not extend to the 18.2 through 18.10 branches, which fall within the affected range, potentially leaving older deployments vulnerable if not upgraded to a supported branch. ### Technical Details of CVE-2026-19478 **GitLab** stated that the vulnerability involves an issue that "under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive." The **CVSS** vector indicates that exploitation can occur over a network by an attacker with no credentials and requires no victim interaction. While the company has not yet named the specific **GraphQL** directive involved or detailed the exact conditions necessary for exploitation, they have confirmed no exploitation of this flaw has been observed in the wild, and no public exploit code was available as of August 18, 2026. ### Secondary Vulnerability: CVE-2026-19650 The same security release also addresses **CVE-2026-19650**, rated High with a **CVSS score of 7.1**. This vulnerability concerns a cross-site request forgery (**CSRF**) weakness within the **GraphQL** multiplex query handler. Unlike the critical flaw, **CVE-2026-19650** requires user interaction for successful exploitation. **GitLab** explained, "**GitLab** has remediated an issue that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in **GraphQL** multiplex query handling." ### Deployment and Disclosure Information The update is designed to be seamless, introducing no new migrations and not requiring downtime for multi-node deployments. This disclosure follows a separate incident in July 2026, where researchers published working exploit code for a different **GitLab RCE** flaw affecting self-managed servers. **GitLab** typically makes technical details of vulnerabilities public on its issue tracker 90 days after the patch release. For these specific flaws, this places the disclosure of detailed technical information around mid-November 2026.