CRITICAL

CVE-2026-19478

Gitlab GitLab 2026-08-17 CVSS v3.1

CVSS

9.1

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

5.81%

Probability of exploitation in next 30 days

92.8th percentile

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/ Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/611377 Not Applicable https://hackerone.com/reports/3926431 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE