Critical GitLab GraphQL Vulnerability CVE-2026-19478 Allows Unauthenticated Project Deletion

GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software. Tracked as CVE-2026-19478, the flaw resides in the GraphQL endpoint and, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. GitLab has rated the vulnerability as Critical and assigned it a CVSS score of 9.4.

The issue was published on August 17, 2026, with security updates released the same day. Affected products include GitLab Community Edition and GitLab Enterprise Edition. The vulnerability's scope is limited to public projects and related user data, though the full extent of potential data exposure has not been independently verified.

GitLab's advisory recommends that all users upgrade to the patched version. The company has not confirmed active exploitation in the wild at the time of disclosure, but the CVSS score and unauthenticated attack vector indicate significant risk for globally deployed instances.