CVE-2026-19650 is a security vulnerability in GitLab Community and Enterprise Editions affecting versions from 18.2 up to but not including 18.11.11, 19.0 up to but not including 19.0.8, 19.1 up to but not including 19.1.6, and 19.2 up to but not including 19.2.4. The flaw involves improper validation of GraphQL multiplex queries, which under certain conditions could allow an unauthenticated attacker to execute mutations via GET requests. This could lead to unauthorized modification of data. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

The vulnerability allows unauthenticated users to perform unauthorized mutations through specially crafted GET requests exploiting improper validation in GraphQL multiplex query handling. This can lead to integrity violations by modifying data without proper authorization. There is no confidentiality impact reported. The vulnerability does not require privileges but does require user interaction. Availability impact is low.

GitLab has released official fixes for this vulnerability in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Users should upgrade affected GitLab CE/EE instances to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on user action to apply the patches. Patch status is confirmed by the vendor advisory embedded in the description.