exploitDog

CVE-2026-112378

Опубликовано: 22 окт. 2026

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

Ссылки

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
Release Notes
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/634027
Permissions Required

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 17.8.0 (включая) до 19.3.6 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 19.4.0 (включая) до 19.4.3 (исключая)

cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 2%

0.00126

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-348

Связанные уязвимости

GHSA-38rf-7hwj-5rg8

CVSS3: 4.3

github

17 дней назад

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

EPSS

Процентиль: 2%

0.00126

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-348