A critical vulnerability in self-managed GitLab Community and Enterprise Edition, tracked as CVE-2026-19478 and rated 9.4 on the CVSS scale, is now being exploited in the wild just days after GitLab disclosed and patched it. The root cause is improper handling of a directive in GitLab's GraphQL API, which lets an unauthenticated remote attacker modify or delete publicly accessible projects and rewrite their associated data. No credentials, account access, or user interaction are required, and the attack can be carried out purely over the network, which is what makes it especially dangerous for any internet-facing self-managed instance. GitLab issued an out-of-band security update on August 17, ahead of its regular monthly release cadence, covering CE and EE versions from 18.2 through 19.2 across several minor version ranges. GitLab.com and GitLab Dedicated customers were already protected and did not need to take action, but self-managed operators who had not yet patched became exposed to opportunistic scanning; researchers observed exploitation attempts hitting honeypot networks within days of the advisory going public. For engineering and platform teams, this is a reminder that GraphQL-based attack surfaces are increasingly a preferred target because they often bypass the access controls and monitoring built around older REST endpoints, and because a single malformed directive can cascade into data integrity problems across many projects at once. Anyone running a self-managed GitLab instance should treat this as an immediate patch priority, verify their instance version against the affected ranges, and review GraphQL query logs for anomalous directive usage in the days before patching. It is also a useful case study for anyone building or auditing their own GraphQL APIs: input validation on nested directives and query complexity needs the same rigor as authentication itself, since this vulnerability class, a permissions bypass through a GraphQL feature working exactly as designed but without adequate checks, tends to recur across many GraphQL implementations, not just GitLab's.