CVE-2026-73135
CVE-2026-73135 · Gitea hidden-owner repository listing disclosure
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
CVSS 5.3 · Mittel · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
gitea
- Softwareversionen
- ≥ 0, ≤ 1.27.1: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39009
- https://github.com/go-gitea/gitea/pull/39012
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-73135