CVE-2026-19478
9.4
CRITICAL · CVSS 3.1 · EPSS 60.2% (pctl 99)
Patch early
EPSS 60.2% — above the 10% action threshold.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Scoring
| CVSS | 9.4 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H |
| EPSS | 60.2% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2026-08-17 |
| Last modified | 2026-09-02 |
Affected (1)
| Vendor | Product |
|---|---|
| gitlab | gitlab |
References
→ the Explorer · watch your stack · NVD