CVE-2026-112326 GitLab CVE debrief

Who should care

Defenders and administrators of GitLab EE instances should assess exposure and prioritize patching to prevent potential misuse by users with read-only permissions. They should verify patch application, restrict user permissions, and monitor vulnerability records for suspicious activity.

Why it matters

Defenders should care about CVE-2026-112326 as it affects GitLab EE instances, allowing users with read-only permissions to potentially delete vulnerability records. This requires verification of patch application, restriction of user permissions, and monitoring of vulnerability records.

• Verification of patch application to prevent vulnerability record deletion.
• Restriction of user permissions to prevent misuse.
• Monitoring of vulnerability records for suspicious activity.

Technical summary

The vulnerability affects GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. An authenticated user with read-only permissions could potentially delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling. This requires verification of patch application, restriction of user permissions, and monitoring of vulnerability records for suspicious activity by defenders and administrators of GitLab EE instances.

Defensive priority

Defenders should prioritize verifying and applying the provided patches to prevent potential deletion of vulnerability records by users with read-only permissions.

Recommended defensive actions

• Verify and apply patches provided by GitLab for affected versions.
• Restrict permissions for users with read-only access to prevent potential misuse.
• Monitor vulnerability records for any suspicious deletions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Evidence is limited to public CVE and NVD information. Defenders should verify patch application, review permissions, and monitor vulnerability records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.