CVE-2026-112326

Published: Oct 22, 2026Modified: Oct 22, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.6 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.

Related CWEs

CWE-460

Improper Cleanup on Thrown Exception

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

References (2)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Source: cve@gitlab.com

https://gitlab.com/gitlab-org/gitlab/-/work_items/633147

Source: cve@gitlab.com

Timeline

No history available yet.