CVE-2026-112378: Use of Less Trusted Source in GitLab

Q: Who can exploit this issue?

An authenticated user could exploit it under certain conditions. The issue affects GitLab EE instances in the listed vulnerable version ranges.

Q: What access could an attacker gain?

The issue could allow access to paid AI features without a valid subscription. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.

Q: Which versions are fixed?

The issue is remediated in GitLab EE 19.3.6, 19.4.3, and 19.5.1. Versions from 17.8 before those respective fixed releases are affected.

Published Oct 21, 2026

Updated

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Affected Software

1 affected component

GitLab GitLab EE>=17.8<19.3.6, >=19.4<19.4.3, >=19.5<19.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.3.6
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.4.3
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.5.1

Event History

Oct 21, 2026

CVE Published

via MITRE·11:33 PM

Data Sourced

via MITRE·11:33 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user could exploit it under certain conditions. The issue affects GitLab EE instances in the listed vulnerable version ranges.

What access could an attacker gain?