Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive
PatchGitLab CE/EEOur summary
GitLab released version 19.2.4, along with updates for older branches, to address two significant vulnerabilities in its GraphQL API. The primary issue, CVE-2026-19478, is a critical code injection flaw that enables unauthenticated attackers to modify or delete public project and user data by exploiting a specific directive. Additionally, CVE-2026-19650 allows cross-site request forgery attacks against logged-in users through improper validation of multiplexed queries. Self-managed instances running versions between 18.2 and 19.2 should upgrade immediately to the latest patched releases.
Below is the opening; the full story is at OX Security.
From OX Security
Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now.
Overview
On August 17, 2026, GitLab published 19.2.4, 19.1.6, 19.0.8, and 18.11.11, fixing two critical GraphQL vulnerabilities.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.