Cross-Origin Resource Manipulation in Gitea by Go Gitea

CVE-2026-107618

What is CVE-2026-107618?

An issue has been identified in Gitea where the endpoint POST /{owner}/{repo}/topics lacks the necessary sign-in middleware for cross-origin protection. This vulnerability enables an attacker to persuade a repository administrator to visit a malicious site and subsequently alter the topics of their Gitea repository. It's important to note that this flaw does not allow access to other repository settings via this route, but it still poses a risk for unauthorized manipulation of repository topics.

References