CVE-2026-19478 GitLab GraphQL unauthenticated project deletion

CVE

CVE-2026-19478

Vendor

GitLab

Product

GitLab CE/EE

Affected versions

18.2–18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, 19.2.0–19.2.3

CVSS

9.1

Published

2026-08-27 06:30

Collected

2026-08-28 07:01

---
id: 6754
title: "CVE-2026-19478 GitLab GraphQL unauthenticated project deletion"
cve: CVE-2026-19478
cvss: 9.1
severity: critical
vendor: "GitLab"
product: "GitLab CE/EE"
affected_versions: "18.2–18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, 19.2.0–19.2.3"
source_domain: github.com
source_url: "https://github.com/EQSTLab/CVE-2026-19478"
published_at: "2026-08-27T06:30:36Z"
tags: ["gitlab", "access-control", "authentication", "vulnerability", "cve", "graphql", "project-deletion", "poc", "unauthenticated", "cve-2026-19478"]
phying_url: "https://phying.com/item/6754"
lang: en
---

# CVE-2026-19478 GitLab GraphQL unauthenticated project deletion

## Summary

EQSTLab's PoC for CVE-2026-19478 (CVSS 9.4): GitLab's @gl_introduced fallback resolves arbitrary zero-arg methods — unauthenticated 'destroy' queries delete public projects; fixed in 18.11.11/19.2.4.

## Why it matters

This vulnerability allows remote unauthenticated actors to delete projects in vulnerable GitLab instances, necessitating immediate patching.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-19478
- **CVSS:** 9.1
- **Vendor:** GitLab
- **Product:** GitLab CE/EE
- **Affected versions:** 18.2–18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, 19.2.0–19.2.3
- **Published:** 2026-08-27T06:30:36Z
- **Original:** https://github.com/EQSTLab/CVE-2026-19478
- **Phying News:** https://phying.com/item/6754