Repository Visibility Issue in Gitea by Go-Gitea

CVE-2026-73135

What is CVE-2026-73135?

Gitea suffers from a vulnerability where repository visibility predicates are inconsistently applied, allowing unauthorized users to access repositories with hidden ownership. This flaw affects certain repository-listing endpoints, which improperly disclose metadata about these repositories despite other access routes correctly returning 404 responses. Consequently, sensitive repository existence and listing information may be exposed beyond the intended visibility settings of the repository owner.

References