The vulnerability received a rating of 9.4 out of 10 on the CVSS scale

A critical vulnerability, CVE-2026-19478, has been discovered in GitLab, which could allow an attacker without an account to remotely modify or delete public projects and user data. The issue is related to the processing of GraphQL directives and received a score of 9.4 out of 10 on the CVSS scale.

To carry out an attack, it is sufficient to have access to the GraphQL API of the vulnerable server via HTTP or HTTPS. A specially crafted request allows bypassing standard processing mechanisms and gaining the ability to affect GitLab objects without authorization or user involvement.

According to Bi.Zone, there are over 9.3 thousand public GitLab services openly accessible in the Russian segment of the internet. The vulnerability affects CE and EE versions from branches 18.2–18.11, 19.0, 19.1, and 19.2. To protect against this, developers have released updates 18.11.11, 19.0.8, 19.1.6, and 19.2.4.

Bi.Zone specialists recommend installing the fixes as soon as possible. If immediate updating is not possible, access to GitLab from the external network should be temporarily restricted, and the GraphQL API should be closed off from untrusted sources using a WAF, reverse proxy, or VPN. However, such measures do not replace the installation of the patch.

Organizations are also advised to check their external perimeter and ensure that no forgotten or unaccounted-for GitLab servers remain.