GitLab CE/EE, cross-site request forgery in the GraphQL multiplex query handler allowing mutations to be executed via GET requests through improper request validation (CVSS 7.1, vendor-assigned). Fixed in the same 2026-08-17 out-of-band release as CVE-2026-19478.

CVE-2026-19478; GitLab ships an out-of-band critical patch for a GraphQL directive flaw that lets an unauthenticated caller modify or delete public projects and user data (CVSS 9.4)

GitLab published an ad-hoc critical patch release on 2026-08-17 (versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for both Community and Enterprise Edition) outside the twice-monthly scheduled cadence it reserves for routine security fixes (GitLab, 2026-08-17). The flaw that earned the out-of-band release is CVE-2026-19478, which GitLab titles a code-injection issue via GraphQL directive and describes as an issue that "under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive" (GitLab, 2026-08-17). France's CERT-FR republished the advisory to its own constituency the following day (CERT-FR, 2026-08-18).

The reason this clears the bar for out-of-band attention rather than the next patch window is the shape of GitLab's own score, not a severity headline. The vendor's vector for CVE-2026-19478 is network-reachable, low-complexity, no privileges required and no user interaction, with low confidentiality impact but high integrity and high availability impact; a flaw whose demonstrated consequence is destroying or altering data rather than reading it. That inverts the usual triage instinct on a source-control platform, where the reflex is to reason about code theft: the loss scenario here is projects and user records being modified or deleted by an unauthenticated caller, which is a restore-from-backup event rather than a disclosure event. Affected versions run from 18.2 up to the four fixed releases (every release line from 18.2 onward, which is a little over a year of releases) and GitLab.com and GitLab Dedicated were already running patched code at disclosure, so the entire exposed population is self-managed instances.

The companion flaw, CVE-2026-19650 at CVSS 7.1, is a cross-site request forgery weakness in the GraphQL multiplex query handler that GitLab states "could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling" (GitLab, 2026-08-17). Its vector requires user interaction, so it needs an authenticated victim to be induced into loading a request, a different exploitation model from the first flaw and a lower one, but it lands on the same fixed releases. Both were reported through GitLab's HackerOne programme, credited to the researchers hiimguardian and kreep respectively.

No party reports exploitation, and there is no public proof-of-concept. There is also, deliberately, no published mechanism: GitLab's policy is that "the issues detailing each vulnerability are made public on our" issue tracker 90 days after the patch release (GitLab, 2026-08-17), so nothing beyond the vendor's one-sentence descriptions exists to reason from and this entry makes no root-cause claim. That withholding is what makes the patch the whole of the response; there is no interim configuration control to fall back on, because nobody outside GitLab knows which directive or which validation path is at fault.

Detection is thin by construction and hunting should not pretend otherwise. What a self-managed operator can do is bound the exposure: GraphQL traffic to /api/graphql from unauthenticated sources is the reachable surface, and in web and application access logs the durable signals are unauthenticated POST or GET requests to that endpoint, and (for the destruction impact specifically) project or user deletion and modification events in GitLab's own audit records that do not correlate with an authenticated session or a known administrator action. Triage: GraphQL is how GitLab's own web UI and integrations talk to the server, so request volume to that endpoint is uninformative on its own; the discriminator is a state-changing outcome (a deleted or altered project, a modified user record) appearing in the audit log with no corresponding authenticated actor, and for the CSRF flaw, mutations arriving as GET rather than POST, which normal clients do not do.