Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-19478 [Critical]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-19478.

Vendor
GitLab
Product
GitLab CE/EE
Affected versions
18.2–18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, 19.2.0–19.2.3
CVSS
9.1
Coverage Span
2026-08-27
Reports
1 related reports

Associated Reports & Timeline

1.
CVE-2026-19478 GitLab GraphQL unauthenticated project deletion
github.com | vulnerability | Critical | | original ↗ | #gitlab | #access-control | #authentication | #vulnerability
EQSTLab's PoC for CVE-2026-19478 (CVSS 9.4): GitLab's @gl_introduced fallback resolves arbitrary zero-arg methods — unauthenticated 'destroy' queries delete public projects; fixed in 18.11.11/19.2.4.
Why it matters: This vulnerability allows remote unauthenticated actors to delete projects in vulnerable GitLab instances, necessitating immediate patching.