GitLab has fixed a critical vulnerability that could allow unauthenticated attackers to perform unauthorized modifications inside code repositories or to completely delete them with a single HTTP request. The patched releases also address a second high-risk cross-site request forgery (CSRF) flaw.
The critical vulnerability, tracked as CVE-2026-19478, is described as a code injection issue through the GraphQL directive and was reported privately to GitLab through its bug bounty program on HackerOne.
However, even if the flaw’s details are not yet public, researchers from security firm watchTowr warn that it’s extremely easy to reverse-engineer the patches and build an exploit.
“WatchTowr was ...