Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 18.2 – < 18.11.11, 19.0 – < 19.0.8, 19.1 – < 19.1.6, 19.2 – < 19.2.4 | 18.11.11 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
HORKimhab/CVE-2026-19650-CVE-2026-19478 ★ 0 · Aug 17, 2026
CVE-2026-19650, CVE-2026-19478 - Draft or TODO
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2026-0303 Kwetsbaarheden verholpen in GitLab door GitLab Inc. NCSC-NL (Netherlands) · Aug 25, 2026
- WID-SEC-2026-2882 GitLab: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Aug 19, 2026
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/612617
- HackerOne Bug Bounty Report #3903669 technical-description exploit permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/