CVE-2026-112378

mediumpriority · track · 0EPSS 0.001 · 2 %ileFRNL

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.12% (2nd) EPSS

CVSS 4.3 · medium

Is it mine?

1 products

Check your exposure

Who says so?

2 sources

ncsc_nl · certfr

EPSS · scored 2026-10-23

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · cve@gitlab.comexploitability 2.8 · impact 1.4

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · NCSC-NL NL

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-348USprimaryCWE-348US

affected products (1)

Products and version ranges known to be affected.

GitLab GitLab≤ vers:unknown/*ncsc_nlNL

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0447Kwetsbaarheden verholpen in GitLab door GitLab Inc.NL2026-10-22csaf · ncsc_nlNL
GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE). Eén kwetsbaarheid is als kritiek aangemerkt. GitLab heeft een kwetsbaarheid verholpen in GitLab Community Edition en Enterprise Edition binnen de versies vanaf 7.0 tot bepaalde 19.x releases.
CERTFR-2026-AVI-1363Multiples vulnérabilités dans GitLabFrançais2026-10-22vendor · certfrFR

sources

Which sources assert this record, and when.

ncsc_nl certfr NVD CVE.org MITRE

published 2026-10-22modified 2026-10-22

related (107)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-31813US	critical9.8OT high	3.54% (89th)	Exploit	2022-06-09
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to b…
CVE-2023-37265US	critical9.8OT elevated	7.36% (94th)	—	2023-07-17
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.…
CVE-2024-45410US	high7.5OT elevated	1.51% (74th)	Exploit	2024-09-19
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Tra…
CVE-2025-59951US	critical9.1OT elevated	4.54% (92nd)	—	2025-10-01
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to…
CVE-2026-16272US	critical9.1	0.14% (3rd)	—	2026-09-09
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers…

+102 more

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan