GitLab patched a critical vulnerability in its Community and Enterprise editions that allows unauthenticated attackers to delete or modify public projects and associated user data. The flaw, CVE-2026-19478, carries a CVSS score of 9.4, placing it in the critical severity category.
The vulnerability resides in GitLab's GraphQL implementation. Attackers without authentication credentials can exploit the flaw to perform destructive operations on publicly accessible projects. This means any public repository hosted on affected GitLab instances faces deletion risk, along with the metadata and user information attached to those projects.
The attack requires no special access or credentials, making exploitation trivial for threat actors scanning the internet for vulnerable GitLab deployments. Organizations running Community Edition or Enterprise Edition installations are directly exposed. Self-hosted GitLab servers and GitLab.com users both require immediate attention.
GitLab classified this vulnerability as critical because unauthenticated remote code execution and data destruction represent the highest-impact attack vectors in version control security. Public projects contain source code, configuration files, and deployment pipelines that attackers could weaponize or simply destroy to disrupt operations.
The company released patches for affected versions but did not disclose the exact version ranges impacted in the initial advisory. Organizations should check GitLab's security bulletin for version-specific update guidance and apply patches immediately.
Defenders should prioritize this remediation above routine updates. The combination of zero authentication requirements, remote exploitation capability, and high-impact consequences makes this vulnerability actively exploitable. Network defenders should monitor GraphQL query logs for suspicious activity targeting project deletion endpoints. Organizations using GitLab should verify their instances are running patched versions and consider implementing network segmentation to limit GraphQL access if immediate patching is delayed.