CVE-2026-19650

This CVE exposes a structural authentication failure in GitLab's GraphQL implementation: the multiplex query handler — a performance optimization allowing multiple operations per request — processed requests without invoking any authentication checks. The result is that mutations could be executed via GET requests without a valid session, something the GraphQL spec explicitly disallows. The affected versions span 18.2 through 19.2, roughly two years of releases. This isn't a one-off coding error; it's a predictable consequence of treating authentication as a front-door gate rather than a property that must be enforced within the execution engine itself. When the multiplex handler was added, developers operated from an established mental model where auth was 'handled upstream' — so nobody asked whether it propagated to the new execution path. The vulnerability was invisible both to developers adding code and to security instrumentation watching for auth failures, because no auth checks fired at all. What elevates this from a simple bypass to a significant risk is the batching capability. A single unauthenticated mutation has limited blast radius due to foreign key constraints and cascading dependencies. A multiplexed request containing thirty coordinated mutations can sequence operations — add a user, escalate their role, trigger a pipeline with a malicious template — in ways a single atomic request cannot. This amplification isn't captured by CVSS or EPSS, which treat each mutation in isolation. If you're running an affected version, patch to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 immediately. More importantly, audit your GraphQL implementation for alternate execution paths (persisted queries, subscriptions, field-level tracing) where the same architectural assumption — that auth propagates automatically — may not hold. Treat authentication as a property of the operation, not the request transport.

Reviewed through automated stages and approved by a human before publication.