---
id: "CVE-2026-112378"
kind: "vulnerability"
aliases: ["CVE-2026-112378"]
title: "GitLab EE: authenticated users reach paid AI features without subscription"
severity: "medium"
cvss: 4.3
epss: 0.00123
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["billing", "gitlab", "self-hosted", "vendor"]
not_affected_if: ["gitlab-ce", "managed-hosting"]
published_at: "2026-10-22T01:16:58+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112378", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112378", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab EE: authenticated users reach paid AI features without subscription

GitLab EE's server-side billing eligibility checks were insufficient in some conditions, letting a logged-in user use paid AI features without a valid subscription. The impact is unpaid use of paid features rather than code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GitLab EE version against the affected range (`17.8` up to `19.3.6`, `19.4` before `19.4.3`, `19.5` before `19.5.1`), for example with `gitlab-rake gitlab:env:info` or the version shown in the Admin Area.

## Fix

- Upgrade GitLab EE to `19.3.6`, `19.4.3`, `19.5.1` or later, matching your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112378
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112378

## From the sources

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_