CVE-2026-112378

4.3 Moyenne

Publiée le 22/10/2026 à 03:16 · Modifiée le 22/10/2026 à 03:16 · Reçue · Source : cve@gitlab.com

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Traduire en français

Produits concernés

GitLab

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	cve@gitlab.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-348

Références

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/634027

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories