CVE-2026-1182
Gitlab 8.14.0 – 18.7.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-1182 is a medium-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Code Repositories (T1213.003); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11501
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public…
more
projects under certain circumstances.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthorized access to confidential data (issue titles) stored in GitLab code repositories.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions so that only authorized users can retrieve confidential issue titles even when the containing project is public.
Prevents improper information flows that would otherwise expose sensitive issue metadata (titles) to users lacking the required confidentiality attribute.
Ensures users and processes operate with the minimum privileges needed, reducing the chance that an authenticated account can reach confidential issue titles.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly addresses removal of confidential data from process memory and similar in-use contexts before exposure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion control directly addresses improper removal of sensitive data.
Data-masking techniques can substitute for removal when full deletion is impractical.
Test-data protection rules require sanitization of production data used in testing.
Classification identifies sensitive data that must be removed before storage or transfer.
Information-transfer rules can require sanitization of sensitive content before sharing.
PII-protection requirements include removing identifiers before storage or disclosure.