NCSC-2026-0303 [1.00] [M/H] Vulnerabilities Fixed in GitLab by GitLab Inc.

unknownpublic exploitCVE-2026-19478 CVE-2026-19650

GitLab Inc. has fixed vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerabilities are present in GitLab's GraphQL implementation. A first vulnerability made it possible for unauthenticated users to perform unauthorized modifications or deletions on public projects and user data through a GraphQL directive. A second vulnerability allowed unauthenticated users to perform mutations through GET requests due to improper validation of GraphQL multiplex queries, where mutation operations were not correctly restricted. This allows unauthorized parties to make unauthorized changes to the state of the server.

CSIRTS triage

vendor: GitLab product: GitLab Community Edition and Enterprise Edition Authentication bypassaffected: multiple versions

What: Two GraphQL vulnerabilities allow unauthenticated users to perform unauthorized modifications and deletions on public projects via an improper directive and to execute mutations through GET requests due to insufficient multiplex query validation.
Who is affected: All GitLab CE and EE deployments with public projects and GraphQL enabled are affected.
Urgency: High urgency; unauthenticated attackers can modify or delete data without authentication.
Action: Update GitLab to the patched version that fixes the GraphQL directive and multiplex query validation issues.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GitLab Community Edition and Enterprise Edition

Get an email when a new GitLab Community Edition and Enterprise Edition advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-18
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0303

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-194786.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 93% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-196500.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-19478	coverage & exploitation status	NVD · CVE.org
CVE-2026-19650	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.ncsc-nl
criticalGitLab security advisory (AV26-827) – Update 1cccs
critical[NEW] [high] GitLab: Multiple vulnerabilities allow file manipulationcert-bund
unknownGitLab Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in GitLab (August 18, 2026)cert-fr-avis
highCVE-2026-19650: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.1…nvd
criticalCVE-2026-19478: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.1…nvd
criticalGitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11gitlab
criticalGitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11gitlab

Recent advisories for GitLab by GitLab

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-84664: Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection confi…nvd · 2026-09-02
highCVE-2026-82289: Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any …nvd · 2026-08-28
high[NEW] [high] GitLab: Multiple vulnerabilitiescert-bund · 2026-08-28
highCVE-2026-75871: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all version…nvd · 2026-08-27
highCVE-2026-19889: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all version…nvd · 2026-08-27
lowCVE-2026-7487: GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.…nvd · 2026-08-26