CVE-2026-117649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117649", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-01T08:50:49.238Z", "datePublished": "2026-11-01T09:48:43.592Z", "dateUpdated": "2026-11-06T15:27:24.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-01T09:48:43.592Z"}, "title": "Gitea private issue disclosure through issue dependency timeline events", "descriptions": [{"lang": "en", "value": "The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "28.3.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f", "name": "GitHub Security Advisory GHSA-p86q-78gw-8f3f", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39942", "name": "Fix: go-gitea/gitea pull request #39942", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40085", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40085", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39839", "name": "Related fix (hidden dependency attachments, 28.2.0): go-gitea/gitea pull request #39839", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39847", "name": "Related fix backport to release/v28 (28.2.0): go-gitea/gitea pull request #39847", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.3.0/", "name": "Gitea 28.3.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "name": "go-gitea/gitea v28.3.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}, {"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "credits": [{"lang": "en", "value": "https://github.com/d3do-23", "type": "reporter"}, {"lang": "en", "value": "https://github.com/kaveeshanirmal141", "type": "reporter"}, {"lang": "en", "value": "https://github.com/manus-pi", "type": "reporter"}, {"lang": "en", "value": "https://github.com/baek9", "type": "reporter"}, {"lang": "en", "value": "https://github.com/bruhdev1290", "type": "reporter"}, {"lang": "en", "value": "https://github.com/yagcioglutoprak", "type": "reporter"}, {"lang": "en", "value": "https://github.com/lunny", "type": "analyst"}, {"lang": "en", "value": "https://github.com/bircni", "type": "remediation developer"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T15:26:50.344391Z", "id": "CVE-2026-117649", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:27:24.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-117649", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:26:50.344391Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:27:18.070Z"}}], "cna": {"title": "Gitea private issue disclosure through issue dependency timeline events", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/d3do-23"}, {"lang": "en", "type": "reporter", "value": "https://github.com/kaveeshanirmal141"}, {"lang": "en", "type": "reporter", "value": "https://github.com/manus-pi"}, {"lang": "en", "type": "reporter", "value": "https://github.com/baek9"}, {"lang": "en", "type": "reporter", "value": "https://github.com/bruhdev1290"}, {"lang": "en", "type": "reporter", "value": "https://github.com/yagcioglutoprak"}, {"lang": "en", "type": "analyst", "value": "https://github.com/lunny"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/bircni"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "lessThan": "28.3.0", "versionType": "semver"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f", "name": "GitHub Security Advisory GHSA-p86q-78gw-8f3f", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39942", "name": "Fix: go-gitea/gitea pull request #39942", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40085", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40085", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39839", "name": "Related fix (hidden dependency attachments, 28.2.0): go-gitea/gitea pull request #39839", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39847", "name": "Related fix backport to release/v28 (28.2.0): go-gitea/gitea pull request #39847", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.3.0/", "name": "Gitea 28.3.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "name": "go-gitea/gitea v28.3.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}, {"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-01T09:48:43.592Z"}}}, "cveMetadata": {"cveId": "CVE-2026-117649", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:27:24.585Z", "dateReserved": "2026-11-01T08:50:49.238Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-11-01T09:48:43.592Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "28.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0."}], "id": "CVE-2026-117649", "lastModified": "2026-11-06T16:17:48.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-117649", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:26:50.344391Z", "version": "2.0.3"}}]}, "published": "2026-11-01T10:18:35.623", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-28.3.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/39839"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/39847"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/39942"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40085"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Information disclosure via unfiltered issue dependency events", "id": "2564537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564537"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.", "A flaw was found in Gitea. This vulnerability leads to unauthorized information disclosure due to missing access control checks on issue dependency events in the web interface and application programming interface (API). If an accessible issue is linked to an issue in a restricted or private repository, any reader\u2014including unauthenticated users on public repositories\u2014can view details from the private issue. Exposed information includes the restricted issue's title, description, state, labels, author, and attachment names."], "name": "CVE-2026-117649", "public_date": "2026-11-01T09:48:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117649\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117649\nhttps://blog.gitea.com/release-of-28.3.0/\nhttps://github.com/go-gitea/gitea/pull/39839\nhttps://github.com/go-gitea/gitea/pull/39847\nhttps://github.com/go-gitea/gitea/pull/39942\nhttps://github.com/go-gitea/gitea/pull/40085\nhttps://github.com/go-gitea/gitea/releases/tag/v28.3.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f"], "statement": "This vulnerability is rated Moderate severity for Red Hat because the impact is restricted to partial metadata leakage rather than arbitrary code execution, privilege escalation, or unauthorized modification of data. Red Hat offerings typically integrate Gitea client modules for automation pipelines rather than deploying the full web issue tracker, minimizing attack surface across typical environments. Furthermore, triggering this leak requires that an authorized collaborator had previously established a cross-repository dependency link between a restricted item and a publicly viewable issue.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,28.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea", "source": "cna", "vendor": "Gitea"}, "product": "gitea", "vendor": "gitea"}], "created": "2026-11-01T11:30:06.659117+00:00", "updated": "2026-11-06T18:15:07.327654+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea"]}