GitLab EE Vulnerability Affecting User Permissions
CVE-2026-112326

3.1LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
21 October 2026

What is CVE-2026-112326?

An issue in GitLab EE allows an authenticated user with read-only permissions to accidentally delete existing vulnerability records due to a flaw in how the system handles errors during record management. This improper cleanup logic fails to differentiate between old and new records, leading to potential data loss under specific conditions. The vulnerability affects various versions of GitLab EE, highlighting the importance of keeping software updated and adhering to best security practices.

Affected Version(s)

GitLab 17.8 < 19.3.6

GitLab 19.4 < 19.4.3

GitLab 19.5 < 19.5.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/633147
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability has been discovered internally by GitLab team member Gregory Havenga
.