CVE-2026-19478 GitLab GraphQL flaw can delete public projects
Source headline: Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Intelligence Summary
GitLab has released security updates for a critical GraphQL vulnerability affecting its Community Edition and Enterprise Edition. Under certain conditions, the flaw tracked as CVE-2026-19478 could allow an unauthenticated attacker to remotely modify or delete public projects and user data. GitLab rates the issue Critical and assigns a CVSS score of 9.4. The risk is tied to GraphQL request handling that can impact both public project content and user data. Apply the published GitLab security updates for your CE or EE installation as soon as possible.
Recommended Action
Check your exposure to CVE-2026-19478 (CVSS 9.4) and apply the vendor fix once available. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.