Cross-Repositories Blob Mount Vulnerability in Gitea
CVE-2026-117685

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-117685?

A vulnerability in Gitea's OCI registry allows for cross-repository blob mounts that improperly validate target and source permissions. This allows a public-only token, which can write to public namespaces, to mount blobs from private packages. Consequently, private data, such as container layers, could be exposed and downloaded by unauthorized users via public packages, posing a significant security risk to sensitive information.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39690
patch
https://github.com/go-gitea/gitea/pull/39853
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/ohxorud-dev
https://github.com/silverwind
https://github.com/wxiaoguang
https://github.com/lunny
https://github.com/bircni
.