This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab fixes 2 vulnerabilities
GitLab fixes 2 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11. The most severe of them are described below, the rest can be found at [1].
Under certain conditions, an unauthenticated remote attacker can use a special directive in a GraphQL query to remotely modify or delete public projects and user data [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.2, <18.11.11; >=19.0, <19.0.8; >=19.1, <19.1.6; >=19.2, <19.2.4
- GitLab Enterprise Edition; >=18.2, <18.11.11; >=19.0, <19.0.8; >=19.1, <19.1.6; >=19.2, <19.2.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
More information:
- CVE-2026-19478 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2026.
Under certain conditions, due to incorrect validation when processing multiple GraphQL queries sent at once, an unauthenticated remote attacker can perform data-modifying operations via GET requests [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.2, <18.11.11; >=19.0, <19.0.8; >=19.1, <19.1.6; >=19.2, <19.2.4
- GitLab Enterprise Edition; >=18.2, <18.11.11; >=19.0, <19.0.8; >=19.1, <19.1.6; >=19.2, <19.2.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
More information:
- CVE-2026-19650 at cve.org, NVD
- CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 18. 8. 2026.