CVE-2026-73135
CVE-2026-73135 · Gitea hidden-owner repository listing disclosure
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
CVSS 5.3 · Medium · EPSS 0.4%
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 0, ≤ 1.27.1: Affected (semver)
No fix published
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39009
- https://github.com/go-gitea/gitea/pull/39012
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-73135