CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

CVSS v3 9.4 CRITICAL

9.4^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/611377	Not Applicable
https://hackerone.com/reports/3926431	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

No history.

Information

Published : 2026-08-17 20:16

Updated : 2026-09-02 12:43

NVD link : CVE-2026-19478

Mitre link : CVE-2026-19478

CVE.ORG link : CVE-2026-19478

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-19478", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19478", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T20:43:52.387073Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "18.2", "lessThan": "18.11.11", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.0.8", "versionType": "semver"}, {"status": "affected", "version": "19.1", "lessThan": "19.1.6", "versionType": "semver"}, {"status": "affected", "version": "19.2", "lessThan": "19.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-17T20:16:41.777", "references": [{"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/611377", "tags": ["Not Applicable"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3926431", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive."}], "lastModified": "2026-09-02T12:43:20.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "D528B105-3DE1-471D-9623-F491A9F0D8C8", "versionEndExcluding": "18.11.11", "versionStartIncluding": "18.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD95576-AC3B-4921-A002-72BD47579B77", "versionEndExcluding": "18.11.11", "versionStartIncluding": "18.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C5EDDC0D-4D7B-4B69-A6F4-DA5A3A3C4638", "versionEndExcluding": "19.0.8", "versionStartIncluding": "19.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A6B9C822-A303-486D-8787-73BA8A82C58B", "versionEndExcluding": "19.0.8", "versionStartIncluding": "19.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "7BB02223-1F27-4183-840A-0AAC4F6F2A5C", "versionEndExcluding": "19.1.6", "versionStartIncluding": "19.1.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "99D8510B-7BB5-4405-A3E6-D030BD420349", "versionEndExcluding": "19.1.6", "versionStartIncluding": "19.1.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "4D5485F8-E798-4A6B-B1C4-873D0DD58D8C", "versionEndExcluding": "19.2.4", "versionStartIncluding": "19.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "F92746EA-6152-4A7C-8509-4A94DF041B94", "versionEndExcluding": "19.2.4", "versionStartIncluding": "19.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}