Markup Endpoint Vulnerability in Gitea Affects Repository Permissions
CVE-2026-71301

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-71301?

A vulnerability in Gitea's repository markup endpoint allows users with limited Wiki access to retrieve sensitive metadata from private pull requests. This occurs because the endpoint does not enforce proper permission checks for viewers. Consequently, an unauthorized user can gain access to private pull request titles and state icons, exposing potential sensitive information across different repository unit permissions.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39045
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/hexcraft-labs
https://github.com/bircni
https://github.com/silverwind
https://github.com/wxiaoguang
.