GitLab shipped an out-of-cycle patch release (versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11) to fix a critical, unauthenticated GraphQL vulnerability tracked as CVE-2026-19478, which carries a CVSS score of 9.4. The flaw stems from a code-injection issue in how GitLab processes a specific GraphQL directive: under certain conditions, an attacker with no account and no prior access could send crafted GraphQL requests that let them modify or delete public projects and associated user data on any GitLab.com, GitLab Dedicated, or self-managed instance. The same security release also closes CVE-2026-19650, a high-severity cross-site request forgery bug in GitLab's GraphQL multiplex query handler that could let an attacker trigger GraphQL mutations through ordinary GET requests when validation is misconfigured. GitLab.com and GitLab Dedicated were patched automatically, so hosted customers don't need to act, but anyone running GitLab CE or EE self-managed between versions 18.2 and the patched releases is exposed until they upgrade. For teams that treat GitLab as their system of record for source code, issues, and CI/CD pipelines, an unauthenticated remote-deletion bug in the core GraphQL API is about as severe as application security gets, since it bypasses the need for compromised credentials entirely. Anyone self-hosting GitLab should prioritize this patch over routine maintenance windows, audit recent project deletions or permission changes for signs of exploitation, and review whether their GraphQL endpoint is reachable from the open internet without additional network-layer restrictions.