Critical GitLab Flaw Lets Attackers Delete Projects

GitLab has shipped security updates for both Community Edition (CE) and Enterprise Edition (EE) patching CVE-2026-19478, a Critical vulnerability rated CVSS 9.4. Under certain conditions, an unauthenticated attacker can reach GitLab’s GraphQL interface and remotely delete or modify public projects and associated user data — no account required.

What the flaw does

The vulnerability sits in GitLab’s GraphQL layer. GraphQL APIs are designed to be flexible query interfaces, but when access controls aren’t enforced at the operation level, they can expose destructive mutations to unauthenticated callers. According to reporting by The Hacker News, the bug lets an attacker remotely modify or delete public projects and user data without authentication. GitLab has not published full technical detail on the “certain conditions” — standard practice during early disclosure to limit exploitation before patches are widely deployed.

The impact is to data integrity: source code repositories, project history, issues, and CI/CD configuration can be destroyed by an unauthenticated attacker who can reach the instance over the network.

Who is affected

Both GitLab CE and EE are in scope. GitLab has not yet published specific affected version ranges in the public-facing summary — check the official security release notes as full detail becomes available.

GitLab.com (SaaS): Already patched. No action needed.

Self-hosted CE or EE: Requires a manual update. The exposure window is the gap between “patch released” and “patch applied” — a gap that historically costs organizations dearly on GitLab bugs. CVE-2021-22205 sat unpatched in production for months at many shops after GitLab fixed it.

What to do

1. Identify your version. Admin area → Help → About GitLab.
2. Update to the latest patched release via your package manager, Helm chart, or Omnibus installer — whichever deployment method you used.
3. If immediate patching isn’t possible, restrict network access to the GitLab instance at the perimeter until the update is applied. Blocking unauthenticated GraphQL access at a WAF or firewall is a short-term mitigation, not a substitute for patching.
4. Review audit logs for unexpected project deletions or modifications if your instance was internet-facing and unpatched for any time after the advisory dropped.

Priority call

Patch this first. CVSS 9.4 with unauthenticated remote access to a destructive operation is about as bad as source-control platform vulnerabilities get. If your GitLab instance holds production secrets, CI/CD pipelines, or proprietary code, this is a patch-before-end-of-business situation — not a “next maintenance window” one.