CVE-2026-112326: Improper Cleanup on Thrown Exception in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user with read-only permissions could potentially trigger the deletion of existing vulnerability records, but only under certain conditions.
Which GitLab EE releases are affected?
Affected releases are all versions from 17.8 before 19.3.6, versions before 19.4.3 in the 19.4 release line, and versions before 19.5.1 in the 19.5 release line.
What is the impact of successful exploitation?
Existing vulnerability records could be permanently deleted. The provided information indicates an integrity impact and does not indicate confidentiality or availability impact.