---
id: "CVE-2026-112326"
kind: "vulnerability"
aliases: ["CVE-2026-112326"]
title: "GitLab EE: read-only users can permanently delete vulnerability records"
severity: "low"
cvss: 3.1
epss: 0.00178
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["devsecops", "gitlab", "runtime", "self-hosted"]
not_affected_if: ["gitlab-ce", "gitlab-com", "patched-version"]
published_at: "2026-10-22T01:16:57+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:47:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112326", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112326", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab EE: read-only users can permanently delete vulnerability records

GitLab EE from 17.8 up to fixed releases in 19.3, 19.4 and 19.5 has a cleanup bug in error handling. An authenticated user with read-only permissions can permanently delete existing vulnerability records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line on the Admin Area page; affected range is `17.8` to before `19.3.6`, `19.4` before `19.4.3`, and `19.5` before `19.5.1`.
- Confirm the instance runs GitLab EE, not CE.

## Fix

- Upgrade GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release in the matching series.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112326
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112326

## From the sources

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_