NCSC-2026-0303 [1.00] [M/H] Vulnerabilities Fixed in GitLab by GitLab Inc.

unknownpublic exploitCVE-2026-19478 CVE-2026-19650

GitLab Inc. has fixed vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerabilities are present in GitLab's GraphQL implementation. A first vulnerability made it possible for unauthenticated users to perform unauthorized modifications or deletions on public projects and user data through a GraphQL directive. A second vulnerability allowed unauthenticated users to perform mutations through GET requests due to improper validation of GraphQL multiplex queries, where mutation operations were not correctly restricted. This allows unauthorized parties to make unauthorized changes to the state of the server.

CSIRTS triage

vendor: GitLab product: GitLab Community Edition and Enterprise Edition Authentication bypassaffected: multiple versions

What: Two GraphQL vulnerabilities allow unauthenticated users to perform unauthorized modifications and deletions on public projects via an improper directive and to execute mutations through GET requests due to insufficient multiplex query validation.
Who is affected: All GitLab CE and EE deployments with public projects and GraphQL enabled are affected.
Urgency: High urgency; unauthenticated attackers can modify or delete data without authentication.
Action: Update GitLab to the patched version that fixes the GraphQL directive and multiplex query validation issues.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GitLab Community Edition and Enterprise Edition

Get an email when a new GitLab Community Edition and Enterprise Edition advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-18
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0303

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-19478	coverage & exploitation status	NVD · CVE.org
CVE-2026-19650	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for GitLab by GitLab

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-19650: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.1…nvd · 2026-08-17
criticalCVE-2026-19478: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.1…nvd · 2026-08-17
mediumCVE-2026-16049: Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to ve…nvd · 2026-08-17
criticalGitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11gitlab · 2026-08-17
criticalGitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11gitlab · 2026-08-17
unknownGitLab security advisory (AV26-814)cccs · 2026-08-13