Live › vulnerability › CVE-2026-112378
Go to dashboardGitLab EE's server-side billing eligibility checks were insufficient in some conditions, letting a logged-in user use paid AI features without a valid subscription. The impact is unpaid use of paid features rather than code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-managed GitLab EE instances on the affected version ranges that have users with accounts and paid AI features in scope. GitLab.com-hosted instances are handled by the vendor, and instances on versions outside the listed ranges are not affected per the description.
No product ranges from the sources yet.
17.8 up to 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1), for example with gitlab-rake gitlab:env:info or the version shown in the Admin Area.19.3.6, 19.4.3, 19.5.1 or later, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-112378")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.