Critical GitLab flaw allows attackers to delete and modify public repos
Brief
GitLab has fixed a critical vulnerability that could allow unauthenticated attackers to perform unauthorized modifications inside code repositories or to completely delete them with a single HTTP request. The patched releases also address a second high-risk cross-site request forgery (CSRF) flaw.
The critical vulnerability, tracked as CVE-2026-19478 , is described as a code injection issue through the GraphQL directive and was reported privately to GitLab through its bug bounty program on HackerOne.
However, even if the flaw’s details are not yet public, researchers from security firm watchTowr warn that it’s extremely easy to reverse-engineer the patches and build an exploit.
“WatchTowr was able to reproduce the vulnerability within minutes of its disclosure, armed only with the advisory details and patch,” Jake Knott, principal security researcher at watchTowr, tells CSO.