CVE-2026-73135
CVE-2026-73135 · Gitea hidden-owner repository listing disclosure
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
CVSS 5.3 · Media · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
gitea
- Versiones
- ≥ 0, ≤ 1.27.1: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39009
- https://github.com/go-gitea/gitea/pull/39012
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-73135