CVE-2026-1732: GitLab Information Disclosure Vulnerability

CVE-2026-1732 Overview

CVE-2026-1732 is an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows authenticated users to view confidential issue titles through improper filtering mechanisms. The vulnerability affects a wide range of GitLab versions spanning from 12.6 through recent releases, potentially exposing sensitive project information to unauthorized authenticated users.

Critical Impact

Authenticated attackers can access confidential issue titles, potentially revealing sensitive project details, security vulnerability information, or business-critical data that should remain restricted.

Affected Products

• GitLab CE/EE versions 12.6 through 18.7.5
• GitLab CE/EE versions 18.8.0 through 18.8.5
• GitLab CE/EE versions 18.9.0 through 18.9.1

Discovery Timeline

• 2026-03-11 - CVE-2026-1732 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-1732

Vulnerability Analysis

This vulnerability is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The flaw exists in GitLab's filtering mechanism that is designed to protect confidential issue information from unauthorized access. Under certain circumstances, the filtering logic fails to properly sanitize or restrict confidential issue titles, allowing authenticated users who should not have access to view this protected information.

The vulnerability exploits a gap in the authorization checks within GitLab's issue management system. When confidential issues are created, they are supposed to be visible only to project members with appropriate permissions, the issue creator, and assignees. However, due to improper filtering, the titles of these confidential issues can leak to other authenticated users who query the system under specific conditions.

Root Cause

The root cause stems from improper removal of sensitive information before transfer (CWE-212). GitLab's filtering logic that processes issue data does not consistently apply confidentiality restrictions when returning issue information under certain query conditions. This allows the confidential issue title metadata to be included in responses to authenticated users who should not have visibility into confidential issues.

Attack Vector

The attack is network-based and requires low privileges (authenticated user account). An attacker with valid GitLab credentials can exploit this vulnerability by crafting specific queries or navigating to certain views that trigger the improper filtering condition. The attack does not require user interaction and can be performed remotely against any affected GitLab instance.

The exploitation typically involves:

1. Authenticating to the target GitLab instance with any valid user account
2. Navigating to or querying endpoints that process issue data
3. Observing responses that improperly include confidential issue titles from projects where the attacker should not have access to confidential information

No verified code examples are available for this vulnerability. For detailed technical information, refer to the HackerOne Report #3532881 and the GitLab Work Item.

Detection Methods for CVE-2026-1732

Indicators of Compromise

• Unusual API query patterns targeting issue endpoints from authenticated users
• Access log entries showing repeated queries to issue listing or search endpoints
• Users accessing confidential issue data outside of their assigned projects

Detection Strategies

• Monitor GitLab audit logs for unusual access patterns to confidential issues
• Review API access logs for queries that may indicate exploitation attempts
• Implement alerting for access to confidential issue metadata by non-privileged users

Monitoring Recommendations

• Enable comprehensive audit logging for issue access in GitLab
• Set up alerts for anomalous query patterns against issue endpoints
• Regularly review access logs for confidential project data

How to Mitigate CVE-2026-1732

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.7.6, 18.8.6, or 18.9.2 or later immediately
• Review access logs to determine if the vulnerability may have been exploited
• Audit confidential issues to assess potential information exposure

Patch Information

GitLab has released patches addressing this vulnerability in versions 18.7.6, 18.8.6, and 18.9.2. Organizations should upgrade to these patched versions as soon as possible. Detailed patch information is available in the GitLab Patch Release Notes.

Workarounds

• Limit the number of users with authenticated access to GitLab instances until patching is complete
• Review and minimize the use of confidential issues for highly sensitive information until the patch is applied
• Consider implementing network-level access controls to restrict GitLab access to trusted networks

# Verify GitLab version and upgrade status
gitlab-rake gitlab:env:info

# Check current GitLab version
cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

# Upgrade GitLab to patched version (example for 18.9.2)
apt-get update && apt-get install gitlab-ee=18.9.2-ee.0