---
id: CVE-2026-112326
title: Improper Cleanup on Thrown Exception in GitLab
summary: >-
  GitLab has remediated an issue in GitLab EE affecting all versions from 17.8
  before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain
  conditions, could have allowed an authenticated user with read-only
  permissions to…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-460
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 17.8 < 19.3.6
  - GitLab >= 19.4 < 19.4.3
  - GitLab >= 19.5 < 19.5.1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T23:33:40.603Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112326'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/work_items/633147'
  - url: >-
      https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
tags:
  - cve.org
ingestedAt: '2026-10-22T00:21:21.865Z'
---

## Overview

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.

## Affected

- `GitLab >= 17.8 < 19.3.6`
- `GitLab >= 19.4 < 19.4.3`
- `GitLab >= 19.5 < 19.5.1`

## Remediation

Upgrade to versions 19.3.6, 19.4.3, 19.5.1 or above.