CVE-2026-112378

MediumCVSS 4.3/10Last modified Nov 4, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-348

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 17.8, < 19.3.6; >= 19.4, < 19.4.3; >= 19.5, < 19.5.1

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/634027Permissions Required

Timeline

Published: Oct 22, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1123797.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-CVE-2026-112385.9Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic CVE-2026-1123809.9Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsA CVE-2026-1123815.9Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origi CVE-2026-112397.5Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere CVE-2026-1123907.5Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC im CVE-2026-1123917.5Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested CVE-2026-1123927.5Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image CVE-2026-1123939.8Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc w CVE-2026-1123948.2Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRa CVE-2026-1123958.2Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-by CVE-2026-1123967.5Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIF