Insufficient Validation in GitLab EE Allows Unauthorized Access to Paid AI Features
CVE-2026-112378
4.3MEDIUM
What is CVE-2026-112378?
GitLab EE has identified a vulnerability that could potentially allow an authenticated user to gain unauthorized access to paid AI features without a proper subscription. This issue stems from inadequate server-side validation during billing eligibility checks, affecting versions from 17.8 prior to 19.3.6, 19.4 prior to 19.4.3, and 19.5 prior to 19.5.1. Users are advised to update their installations to mitigate the risk of unauthorized access.
Affected Version(s)
GitLab 17.8 < 19.3.6
GitLab 19.4 < 19.4.3
GitLab 19.5 < 19.5.1
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This vulnerability has been discovered internally by GitLab team member Halil Coban