GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws
GitLab has released security updates for its Community Edition and Enterprise Edition platforms to address two vulnerabilities, including one rated critical. The flaws were reported through the company's bug bounty program and affect multiple supported versions. CVE-2026-19478 is a code injection issue that allows remote attackers to tamper with or delete public projects and user data via GraphQL directives without authentication under certain conditions. CVE-2026-19650 is a CSRF vulnerability stemming from insufficient validation in GraphQL multiplexed query handling, enabling mutation execution through GET requests. Both CVEs received high CVSS scores, prompting GitLab to urge immediate upgrades to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
Security NEXTAug 18, 2026Translated from Japanese