GitLab releases emergency patch for critical 9.4 flaw allowing unauthenticated project deletion

GitLab has released an out-of-band security update to address a critical vulnerability affecting its Community Edition (CE) and Enterprise Edition (EE) software. The flaw, tracked as CVE-2026-19478 and rated Critical with a CVSS score of 9.4, could under certain conditions allow an unauthenticated attacker to remotely modify or delete public projects and user data.

The patch was published on August 17, 2026, outside the company's regular twice-monthly release schedule, which falls on the second and fourth Wednesdays. The previous routine update, released five days earlier, did not include any critical-rated fixes.

Only self-managed installations require action. The fixes are available in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. According to the company, GitLab.com and GitLab Dedicated are already running the patched version, so customers using those platforms do not need to take any action.

The following versions are affected: — All versions from 18.2 before 18.11.11 — 19.0 before 19.0.8 — 19.1 before 19.1.6 — 19.2 before 19.2.4

Notably, the fixes do not extend to the 18.2 through 18.10 branches, which fall within the affected range. This means users running older versions in those branches remain vulnerable and must upgrade to a supported patched version.

GitLab stated that it has remediated an issue that, under certain conditions, could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive. The published CVSS vector indicates that the vulnerability can be exploited over a network by an attacker holding no credentials, and without any action required from the victim. The company did not disclose the specific GraphQL directive involved or the exact conditions needed for exploitation, leaving administrators to rely on the patch as the sole mitigation.

This is the second critical vulnerability in GitLab's GraphQL implementation in recent months. In May 2026, the company patched CVE-2026-18472, a critical flaw with a CVSS score of 9.6 that allowed unauthenticated attackers to execute arbitrary pipelines. The recurrence of such high-severity issues in GraphQL suggests that the feature remains a persistent attack surface. GitLab recommends that all self-managed users apply the latest updates immediately to prevent potential data loss or unauthorized access.