GitLabCVE-2026-112378

GitLab: authenticated user could access paid AI features without

CVE-2026-112378 · Published Oct 22, 2026 · updated Oct 30, 2026

Medium4.3

Fix: upgrade to 19.3.6 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 17.8, < 19.3.6	19.3.6
	>= 19.4, < 19.4.3	19.4.3
	>= 19.5, < 19.5.1	19.5.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-348

More GitLab advisories

All GitLab

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: improper access controlCVE-2026-14288fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 5.9Oct 22

GitLab: improper authorizationCVE-2026-16255fixed in 19.3.6 +2 Low 2.7Oct 22

GitLab: improper authorizationCVE-2026-103515fixed in 19.3.6 +2