GitLab closes critical security vulnerability for project deletion

On August 17, GitLab released an important patch for several versions to close two discovered vulnerabilities. This patch affects versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 and particularly includes the critically rated vulnerability identified as CVE-2026-19478.

The vulnerability received a CVSS rating of 9.4 and allowed unauthenticated attackers to modify or delete publicly accessible projects and user information without requiring a GitLab user account. This means such attacks could potentially be carried out on inadequately secured GitLab instances on the internet.

According to reports, the vulnerability was found in the platform’s GraphQL API, which allowed attackers direct access to data and structures within GitLab environments. GitLab developers have emphasized in their communications that protecting projects and user data is of utmost priority and that they will continue to work on improving platform security.

There are over 9,300 public GitLab services in the Russian internet landscape, some of which may have been affected by this vulnerability. The incident has also drawn attention in security circles, highlighting the need for timely updates of existing systems to minimize such attack vectors.

GitLab's measures aim to ensure the protection of users as well as the integrity of hosted projects on the platform, especially given the potential dangers arising from such vulnerabilities.