GitLab CE and EE Emergency Out-of-Band Patch Addresses Critical Unauthenticated Data Deletion Flaw (CVE-2026-19478)

Scope: GitLab Community Edition and Enterprise Edition Self-Managed Installations Versions 18.2 through 19.2.3

Severity: Red

GitLab released an emergency security update on August 17, 2026, five days outside its usual twice-monthly patch schedule, to address CVE-2026-19478 (CVSS 9.4), a critical GraphQL directive flaw that allows any unauthenticated network-accessible attacker to remotely modify or delete public projects and user data without credentials or victim interaction. The fact that GitLab accelerated this patch well outside its normal release cadence signals the severity of the risk and the likelihood of active exploitation developing quickly. Note that only self-managed GitLab installations require action. GitLab.com and GitLab Dedicated are already running the patched version. A companion high-severity CSRF flaw (CVE-2026-19650, CVSS 7.1) in the GraphQL multiplex query handler was also addressed in the same release. Self-managed GitLab administrators must upgrade to version 19.2.4, 19.1.6, 19.0.8, or 18.11.11 immediately, noting that the 18.2 through 18.10 branches fall within the affected range but do not receive the fix and require urgent upgrade to a supported branch.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.