Cross-Site Information Exposure in Gitea

CVE-2026-117649

What is CVE-2026-117649?

An issue exists in Gitea that involves cross-site information exposure via the timeline API and web issue page. Specific dependency events, namely 'dependency added' and 'dependency removed', are not filtered properly, allowing users without access to certain issues to see information such as titles, states, and labels through the API. This could lead to unintended disclosure of sensitive issue details from private repositories, as linked issues remain visible despite the user's lack of permissions. The flaw has been addressed in version 28.3.0, where appropriate permission checks have been enforced for dependency events.

References