Cross-Origin Resource Manipulation in Gitea by Go Gitea
CVE-2026-107618

8.1HIGH

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
18 October 2026

What is CVE-2026-107618?

An issue has been identified in Gitea where the endpoint POST /{owner}/{repo}/topics lacks the necessary sign-in middleware for cross-origin protection. This vulnerability enables an attacker to persuade a repository administrator to visit a malicious site and subsequently alter the topics of their Gitea repository. It's important to note that this flaw does not allow access to other repository settings via this route, but it still poses a risk for unauthorized manipulation of repository topics.

Affected Version(s)

Gitea 0 <= 28.1.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39839
patch
https://github.com/go-gitea/gitea/pull/39847
patch

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/bruhdev1290
https://github.com/silverwind
https://github.com/wxiaoguang
https://github.com/bircni
.