{"id":"CVE-2026-112326","kind":"vulnerability","aliases":["CVE-2026-112326"],"related":[],"title":"GitLab EE: read-only users can permanently delete vulnerability records","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.","summary":"GitLab EE from 17.8 up to fixed releases in 19.3, 19.4 and 19.5 has a cleanup bug in error handling. An authenticated user with read-only permissions can permanently delete existing vulnerability records.","severity":"low","cvss":3.1,"epss":0.00178,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devsecops","gitlab","runtime","self-hosted"],"not_affected_if":["gitlab-ce","gitlab-com","patched-version"],"how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line on the Admin Area page; affected range is `17.8` to before `19.3.6`, `19.4` before `19.4.3`, and `19.5` before `19.5.1`.\n- Confirm the instance runs GitLab EE, not CE.","fix":"- Upgrade GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release in the matching series.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:47:28+00:00","updated_at":"2026-10-25T04:47:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:47:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release in the matching series.","reach":"network","title":"GitLab EE: read-only users can permanently delete vulnerability records","impact":"low","summary":"GitLab EE from 17.8 up to fixed releases in 19.3, 19.4 and 19.5 has a cleanup bug in error handling. An authenticated user with read-only permissions can permanently delete existing vulnerability records.","category":"runtime","nicknames":[],"who_cares":["gitlab","self-hosted","devsecops"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated read-only user permanently deletes existing vulnerability records.","analyst_note":"","how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line on the Admin Area page; affected range is `17.8` to before `19.3.6`, `19.4` before `19.4.3`, and `19.5` before `19.5.1`.\n- Confirm the instance runs GitLab EE, not CE.","needs_analyst":false,"not_affected_if":["gitlab-ce","gitlab-com","patched-version"],"who_is_affected":"Self-managed GitLab EE instances in the affected version ranges where users have read-only roles and the vulnerability management feature is in use. The sources do not describe the exact conditions that trigger the flaw, so the scope beyond that is unknown. GitLab.com and CE installs are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000628,"input_tokens":3414,"output_tokens":573,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112326':14A,17A '-2026':13A,16A '17.8':27B,70C '19.3':33B '19.3.6':72C '19.4':34B,73C '19.4.3':75C '19.5':36B,77C '19.5.1':79C 'affect':66C 'allow':86C 'authent':45B,88C 'bug':40B 'certain':82C 'cleanup':39B,104C 'condit':83C 'could':84C 'creat':117C 'cve':12A,15A 'delet':9A,54B,97C 'devsecop':18B 'distinguish':109C 'due':101C 'ee':2A,25B,65C 'error':42B,120C 'exist':55B,98C,113C 'fail':107C 'fix':30B 'gitlab':1A,19B,24B,58C,64C 'handl':43B,121C 'host':23B 'improp':103C 'issu':62C 'logic':105C 'newli':116C 'one':118C 'perman':8A,53B,96C 'permiss':51B,94C 'pre':112C 'pre-exist':111C 'read':4A,49B,92C 'read-on':3A,48B,91C 'record':11A,57B,100C,114C 'releas':31B 'remedi':60C 'runtim':20B 'self':22B 'self-host':21B 'user':6A,46B,89C 'version':68C 'vulner':10A,56B,99C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab EE instances in the affected version ranges where users have read-only roles and the vulnerability management feature is in use. The sources do not describe the exact conditions that trigger the flaw, so the scope beyond that is unknown. GitLab.com and CE installs are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112326","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112326","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112326","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}