1 hour ago
We have information regarding several critical vulnerabilities affecting GitLab CE/EE, a platform widely used by companies to manage source code repositories, projects, and development processes. 
One of the most interesting flaws, identified as CVE-2026-19478, could allow attackers, under certain conditions, to modify or delete public projects and user data without authentication by exploiting a weakness related to GraphQL.
Another vulnerability, CVE-2026-19650, involves insufficient request validation during GraphQL query processing, potentially allowing unauthorized actions.
Additionally, CVE-2026-85706 could allow unauthorized access to server files in certain vulnerable versions of GitLab. Active exploitation of this vulnerability has reportedly been observed.
Installations still running vulnerable versions could represent attractive targets due to the sensitive information and projects they manage.
Has anyone found instances affected by these vulnerabilities?
Are any new proof-of-concept (PoC) exploits or technical analyses being shared for these flaws?
One of the most interesting flaws, identified as CVE-2026-19478, could allow attackers, under certain conditions, to modify or delete public projects and user data without authentication by exploiting a weakness related to GraphQL.
Another vulnerability, CVE-2026-19650, involves insufficient request validation during GraphQL query processing, potentially allowing unauthorized actions.
Additionally, CVE-2026-85706 could allow unauthorized access to server files in certain vulnerable versions of GitLab. Active exploitation of this vulnerability has reportedly been observed.
Installations still running vulnerable versions could represent attractive targets due to the sensitive information and projects they manage.
Has anyone found instances affected by these vulnerabilities?
Are any new proof-of-concept (PoC) exploits or technical analyses being shared for these flaws?