Medium
Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
Type: advisorySources: OSV
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-1732
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:54 UTC · Revision 1
Source evidence
Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
core-osv · Original sourcePublished 11 Mar 2026, 15:37 UTC
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.
osv:CVE-2026-1732
Complete source record
{
"id": "40a0b1d2f8e59a9f391c5cf61e04792d217f9d896d6f8498582bd0ab8f462bf7",
"url": "https://osv.dev/vulnerability/CVE-2026-1732",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Improper Removal of Sensitive Information Before Storage or Transfer in GitLab",
"summary": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.",
"evidence": "osv:CVE-2026-1732",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-1732",
"aliases": [
"BIT-gitlab-2026-1732",
"CVE-2026-1732"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/gitlab-org/gitlab",
"type": "GIT",
"events": [
{
"introduced": "11ac4a9aa216b39b2880f8a647f39f6ea77cef1a"
},
{
"fixed": "4ff507582a71b3fee0ef5a34e7ab583281391758"
},
{
"introduced": "1010a9b2b769993080ce8399fd25e77c54e1ad1c"
},
{
"fixed": "5831acc89ce4c662f751bb062d1df3bcf2b8cb4e"
},
{
"introduced": "20fe49b575fedd2b8cadc2c0640178879854aeb3"
},
{
"fixed": "fcb80522240b3ea1821ac6c2d52b00159bcda5a6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "12.6.0"
},
{
"fixed": "18.7.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "12.6.0"
},
{
"fixed": "18.7.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "18.8.0"
},
{
"fixed": "18.8.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "18.8.0"
},
{
"fixed": "18.8.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "18.9.0"
},
{
"fixed": "18.9.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "18.9.0"
},
{
"fixed": "18.9.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v18.9.0-ee",
"v18.8.1-ee",
"v18.8.3-ee",
"v18.8.0-ee"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1732.json"
}
}
],
"modified": "2026-10-30T10:30:22.548537216Z",
"provider": "osv",
"references": [
"https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/",
"https://gitlab.com/gitlab-org/gitlab/-/work_items/588380",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1732.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-1732",
"https://hackerone.com/reports/3532881"
],
"provider_metadata": {
"cwe_ids": [
"CWE-212"
],
"cna_assigner": "GitLab",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "12.6"
},
{
"fixed": "18.7.6"
},
{
"introduced": "18.8"
},
{
"fixed": "18.8.6"
},
{
"introduced": "18.9"
},
{
"fixed": "18.9.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "12.6"
},
{
"fixed": "18.7.6"
},
{
"introduced": "18.8"
},
{
"fixed": "18.8.6"
},
{
"introduced": "18.9"
},
{
"fixed": "18.9.2"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1732.json"
}
},
"related_cves": [
{
"value": "CVE-2026-1732",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508730,
"published_at": "2026-03-11T15:37:26.891+00:00"
}