CVE-2026-1732
Gitlab 12.6.0 – 18.7.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-1732 is a medium-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Code Repositories (T1213.003); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11188
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain…
more
circumstances.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper filtering enables unauthorized access to sensitive data (issue titles) stored in GitLab, directly facilitating T1213.003 Code Repositories.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks so that only permitted users can retrieve confidential issue titles, directly blocking the improper disclosure path.
Requires output filtering of sensitive fields (issue titles) before they are returned to users, addressing the exact CWE-212 filtering failure.
Enforces information-flow rules between issue objects and user sessions to prevent unauthorized leakage of confidential metadata.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly addresses removal of confidential data from process memory and similar in-use contexts before exposure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion control directly addresses improper removal of sensitive data.
Data-masking techniques can substitute for removal when full deletion is impractical.
Test-data protection rules require sanitization of production data used in testing.
Classification identifies sensitive data that must be removed before storage or transfer.
Information-transfer rules can require sanitization of sensitive content before sharing.
PII-protection requirements include removing identifiers before storage or disclosure.