CVE-2026-19650: 
GitLab vulnerability analysis and mitigation

CVE-2026-19650 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab CE/EE's GraphQL multiplex query handling that allows unauthenticated attackers to execute mutations via HTTP GET requests under certain conditions. Disclosed on August 17, 2026, it affects all GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. It carries a CVSS v3.1 base score of 7.1 (High), with high integrity impact and low availability impact, requiring user interaction but no authentication (GitHub Advisory, GitLab Patch Release).

The root cause is improper request validation in GitLab's GraphQL multiplex query handling (CWE-352: Cross-Site Request Forgery). Normally, GraphQL mutations are restricted to POST requests to prevent CSRF attacks, as browsers do not automatically send cross-origin POST requests with custom headers. However, due to a flaw in how GitLab processes multiplexed GraphQL queries, mutations could be triggered via GET requests, bypassing standard CSRF protections. An attacker could craft a malicious link or page that, when visited by an authenticated GitLab user, causes the victim's browser to issue a GET request that executes a state-changing GraphQL mutation on their behalf (GitHub Advisory, HackerOne Report).

Successful exploitation allows an unauthenticated attacker to perform unauthorized data modifications on GitLab instances — including potentially deleting public projects or altering repository settings — by tricking an authenticated user into visiting a malicious link. The integrity impact is rated High, meaning significant data modification is possible, while availability impact is Low (minor service degradation). There is no confidentiality impact, as the vulnerability does not expose sensitive data directly (GitHub Advisory, The Hacker News).

As of the disclosure date, there are no confirmed working exploits or evidence of in-the-wild exploitation. A GitHub repository (HORKimhab/CVE-2026-19650-CVE-2026-19478) was flagged as a potential PoC but was assessed with high confidence to contain only boilerplate README content with no actual exploit code or reproduction steps (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (a victim must click a malicious link), which reduces the likelihood of automated mass exploitation (GitHub Advisory).

1. Reconnaissance: Identify internet-facing GitLab CE/EE instances running affected versions (18.2–18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, or 19.2.0–19.2.3) using tools like Shodan or Censys, or by checking the GitLab version page at /help.
2. Craft malicious GraphQL GET request: Construct a URL targeting the GitLab GraphQL endpoint (e.g., /api/graphql) with a multiplexed query payload embedded as a GET parameter that includes a mutation (e.g., deleting a project or modifying settings).
3. Deliver to authenticated victim: Embed the crafted URL in a phishing email, malicious webpage, or social engineering lure targeting a GitLab user with sufficient privileges on the target instance.
4. Trigger mutation: When the authenticated victim's browser follows the link, the GET request is sent to the GitLab server with the victim's session credentials, and the GraphQL mutation executes in their context due to the improper request validation flaw.
5. Achieve objective: The mutation completes server-side — potentially deleting projects, modifying repository settings, or performing other state-changing operations — without the victim's explicit intent (GitHub Advisory, HackerOne Report).

• Network: Unusual HTTP GET requests to /api/graphql containing GraphQL mutation syntax in query parameters; requests originating from unexpected referrer domains targeting the GraphQL endpoint.
• Logs: GitLab application logs showing GraphQL mutations executed via GET method (rather than POST); unexpected project deletion, membership changes, or settings modifications logged in GitLab audit events.
• Application: Unexplained changes to project settings, repository configurations, or group memberships; projects deleted or made private/public without corresponding user-initiated actions in audit trails.

GitLab has released patched versions addressing this vulnerability: 18.11.11, 19.0.8, 19.1.6, and 19.2.4. All GitLab CE/EE administrators running versions from 18.2 onward should upgrade to the appropriate patched release immediately, prioritizing internet-facing instances. No specific configuration-based workaround has been published; upgrading is the recommended remediation (GitLab Patch Release, GitHub Advisory).

The vulnerability received coverage from The Hacker News, which highlighted the risk of unauthenticated attackers deleting public projects via the GraphQL flaw (The Hacker News). Security community outlets including SecurityOnline, CyberPress, and Bulwark Black published patch runbooks and advisories shortly after disclosure. The Australian Cyber Security Centre (AusCERT) issued bulletin ESB-2026.9629 referencing the vulnerability. Overall community sentiment emphasized the importance of prompt patching for internet-facing GitLab instances, though the requirement for user interaction tempered urgency compared to fully unauthenticated RCE-class vulnerabilities.