Information Disclosure in Gitea Product by Go-Gitea Vendor

CVE-2026-117646

What is CVE-2026-117646?

The vulnerability allows potential exposure of private repository information and metadata in Gitea due to insufficient access token verification. Users with a personal access token restricted to public resources can inadvertently access information about private repositories, including their names and user-associated activities like stars and watches. This flaw affects the user profile and organization home pages, with private repositories being displayed without proper restrictions in signed-in sessions. Although sensitive content remains protected, repository metadata is disclosed, raising concerns about privacy and secure access.

References