Critical GitLab flaw allows attackers to delete and modify public repos
Summary
GitLab has patched a critical vulnerability (CVE-2026-19478) that allowed unauthenticated attackers to modify or delete public code repositories. Researchers warn that exploits are easy to develop from the patch details, posing a risk of supply chain attacks. A second high-risk CSRF flaw (CVE-2026-19650) was also fixed.
IFF Assessment
This vulnerability allows unauthenticated attackers to modify or delete code repositories, directly impacting the integrity and availability of software development projects.
Severity
Defender Context
Defenders should prioritize patching GitLab instances immediately to mitigate the risk of unauthorized code modification and deletion, which could lead to supply chain compromises. Organizations should also consider measures like making repositories private and restricting access to the GraphQL API endpoint as immediate mitigation strategies.