CVE-2026-112378: gitlab gitlab

CVSS 4.3 (medium) · published 2026-10-22

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Affected products (NVD): gitlab gitlab

Fixed in (NVD): 19.3.6, 19.4.3

Weakness: CWE-348

Source: NVD CVE-2026-112378

References

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/634027

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.