cve-2026-19478

CRITICAL CVSS 9.4 opencve
Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Timeline
Published
2026-08-17 20:16 UTC
Last Modified
2026-09-02
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-94
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 9.4 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H mitre
3.1 9.4 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H nvd
3.1 9.4 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H opencve
References

No references available.

Linked Vulnerabilities
3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 freebsd 

{
  "cve": "CVE-2026-19478",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[18.2,18.11.11)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[19.0,19.0.8)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[19.1,19.1.6)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[19.2,19.2.4)"
            }
          }
        ],
        "enrichment": {
          "confidence": 90.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 90.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "GitLab",
          "source": "cna",
          "vendor": "GitLab"
        },
        "product": "gitlab",
        "vendor": "gitlab"
      }
    ],
    "created": "2026-08-17T22:00:03.833192+00:00",
    "updated": "2026-08-24T16:30:07.312117+00:00",
    "vendors": [
      "gitlab",
      "gitlab$PRODUCT$gitlab"
    ]
  },
  "epss": {
    "score": 0.60204
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-08-17T20:04:46.400000+00:00",
    "description": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.4,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/19xxx/CVE-2026-19478.json",
    "references": [
      "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
      "https://gitlab.com/gitlab-org/gitlab/-/work_items/611377",
      "https://hackerone.com/reports/3926431"
    ],
    "title": "Improper Control of Generation of Code ('Code Injection') in GitLab",
    "updated": "2026-08-17T20:44:03.074000+00:00",
    "vendors": [
      "gitlab",
      "gitlab$PRODUCT$gitlab"
    ],
    "weaknesses": [
      "CWE-94"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*"
    ],
    "created": "2026-08-17T20:16:41.777000+00:00",
    "description": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.4,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-19478.json",
    "references": [
      "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
      "https://gitlab.com/gitlab-org/gitlab/-/work_items/611377",
      "https://hackerone.com/reports/3926431"
    ],
    "title": null,
    "updated": "2026-09-02T12:43:20.490000+00:00",
    "vendors": [
      "gitlab",
      "gitlab$PRODUCT$gitlab"
    ],
    "weaknesses": [
      "CWE-94"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-08-17T20:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Improper Control of Generation of Code ('Code Injection') in GitLab",
              "old": null
            },
            "type": "title"
          },
          {
            "details": [
              "gitlab",
              "gitlab$PRODUCT$gitlab"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "CWE-94"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "gitlab",
                "gitlab$PRODUCT$gitlab"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
                "https://gitlab.com/gitlab-org/gitlab/-/work_items/611377",
                "https://hackerone.com/reports/3926431"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 9.4,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "fdc5d2ff-37b9-4868-a107-87f9c233d344"
      },
      {
        "created": "2026-08-17T21:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "406ea097-a67f-4a91-a04e-7b935038a5b7"
      },
      {
        "created": "2026-09-02T13:00:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "169b4741-1558-48e1-ad96-abd27ac38ea3"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-08-17T20:04:46.400000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9.4,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.60204
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
        "https://gitlab.com/gitlab-org/gitlab/-/work_items/611377",
        "https://hackerone.com/reports/3926431"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Improper Control of Generation of Code ('Code Injection') in GitLab",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-09-02T12:43:20.490000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "gitlab",
        "gitlab$PRODUCT$gitlab"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-94"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-08-17T20:04:46.400000+00:00",
    "description": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Improper Control of Generation of Code ('Code Injection') in GitLab",
    "updated": "2026-08-17T20:43:58.087000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/19xxx/CVE-2026-19478.json",
    "weaknesses": []
  }
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Nuclei templates
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON