Trending
CVE-2026-19478

CVE detail

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

CVSS 9.4 · CriticalBuzz score 42.0

Buzz score

Why this CVE is surfacing

Buzz score total 42.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

22.0

8 evidence mentions in the snapshot

Diversity score

20.0

8 sources across 3 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 9; within the 30d window
Peak daily: 4; highest bucket

Evidence

Source links by recency

Newest mentions first

9 source links · newest first

GitLab CVE-2026-19478: GraphQL authorization bypassHacker News
Linked URL: https://techupdate24.com/gitlab-cve-2026-19478-graphql-flaw/ | Posted by sysadmin_diarie | 1 points | 0 comments
communitynews.ycombinator.comAug 19, 2026, 7:29 AM
Critical GitLab Zero-Click Flaw Poses Mitigation ChallengesDark Reading
l details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.
newswww.darkreading.comAug 18, 2026, 9:25 PM
Critical GitLab flaw allows attackers to delete and modify public reposCSO Online
releases also address a second high-risk cross-site request forgery (CSRF) flaw. The critical vulnerability, tracked as CVE-2026-19478 , is described as a code injection issue through the GraphQL directive and was reported privately to GitLab through its bug bounty program on HackerOne. However, even if the flaw’s details are not yet public, researcher
newswww.csoonline.comAug 18, 2026, 7:33 PM
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)Help Net Security
installations be upgraded … More → The post Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) appeared first on Help Net Security .
newswww.helpnetsecurity.comAug 18, 2026, 11:38 AM
GitLab Patches Critical Unauthenticated GraphQL VulnerabilitySecurity Affairs
projects on self-managed servers. GitLab pushed out an emergency patch this week to address a critical flaw, tracked as CVE-2026-19478 (CVSS score of 9.4), that could let an attacker with zero credentials remotely modify or delete public projects and user […]
newssecurityaffairs.comAug 18, 2026, 8:44 AM
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public ProjectsThe Hacker News
ould allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
newsthehackernews.comAug 17, 2026, 9:03 PM
https://hackerone.com/reports/3926431hackerone.com
No excerpt available.
Exploithackerone.comAug 17, 2026, 8:16 PM
https://gitlab.com/gitlab-org/gitlab/-/work_items/611377gitlab.com
No excerpt available.
Exploitgitlab.comAug 17, 2026, 8:16 PM
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/docs.gitlab.com
No excerpt available.
Vendor Advisorydocs.gitlab.comAug 17, 2026, 8:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-75911
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command…
CVSS 8.5 · High
3 mentions
CVE-2026-75858
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement(…
CVSS 8.5 · High
3 mentions
CVE-2026-73073
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficie…
CVSS 7.1 · High
3 mentions
CVE-2026-45117
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the con…
CVSS 9.8 · Critical
4 mentions
CVE-2026-73343
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVSS 10.0 · Critical
1 mention
CVE-2026-50187
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to sour…
CVSS 8.8 · High
3 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-19478.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

Product query unavailableNo valid raw CPE 2.3 product record is available for this CVE, so no product-level Shodan query is shown.

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-19478Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Undergoing Analysis

Published

Aug 17, 2026

Modified

Aug 18, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CWE IDs

Vendor classifications

Unavailable

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): Low. There is a limited impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses