Repository Exposure in Gitea by Go-Gitea
CVE-2026-119533

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-119533?

A vulnerability in Gitea's project boards allows unauthorized viewers to see references to private pull requests associated with issues on public boards. Although sensitive details such as the pull request body, diffs, and files are not exposed, the visibility of the path and state of private repositories can lead to unauthorized disclosures. This issue has been addressed with an update that restricts the visibility of linked pull requests based on the viewer’s access permissions.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/40016
patch
https://github.com/go-gitea/gitea/pull/40134
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/GrimTheRipper-SOSECURE
https://github.com/bruhdev1290
https://github.com/yagcioglutoprak
https://github.com/lunny
https://github.com/basavaraj-sm05
.