GitLab's CVSS 9.4 GraphQL bug lets unauthenticated attackers delete public projects
GitLab shipped an out-of-band patch for CVE-2026-19478 (CVSS 9.4), a code injection flaw in a GraphQL directive letting unauthenticated attackers modify or delete public projects and user data on self-managed CE/EE. Self-hosted versions 18.2 through 19.2.3 are affected; upgrade to 18.11.11, 19.0.8, 19.1.6, or 19.2.4. GitLab.com is already patched, with no exploit seen yet.