CVE-2026-119533

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119533", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-01T08:50:49.246Z", "datePublished": "2026-11-01T09:48:55.849Z", "dateUpdated": "2026-11-06T15:09:21.844Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-01T09:48:55.849Z"}, "title": "Gitea private pull request disclosure on project boards", "descriptions": [{"lang": "en", "value": "Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "28.3.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg", "name": "GitHub Security Advisory GHSA-c45m-jm46-mwxg", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/40016", "name": "Fix: go-gitea/gitea pull request #40016", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40134", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40134", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.3.0/", "name": "Gitea 28.3.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "name": "go-gitea/gitea v28.3.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "credits": [{"lang": "en", "value": "https://github.com/GrimTheRipper-SOSECURE", "type": "reporter"}, {"lang": "en", "value": "https://github.com/bruhdev1290", "type": "reporter"}, {"lang": "en", "value": "https://github.com/yagcioglutoprak", "type": "reporter"}, {"lang": "en", "value": "https://github.com/lunny", "type": "analyst"}, {"lang": "en", "value": "https://github.com/basavaraj-sm05", "type": "remediation developer"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T15:08:46.983794Z", "id": "CVE-2026-119533", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:09:21.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-119533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:08:46.983794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:09:08.211Z"}}], "cna": {"title": "Gitea private pull request disclosure on project boards", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/GrimTheRipper-SOSECURE"}, {"lang": "en", "type": "reporter", "value": "https://github.com/bruhdev1290"}, {"lang": "en", "type": "reporter", "value": "https://github.com/yagcioglutoprak"}, {"lang": "en", "type": "analyst", "value": "https://github.com/lunny"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/basavaraj-sm05"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "lessThan": "28.3.0", "versionType": "semver"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg", "name": "GitHub Security Advisory GHSA-c45m-jm46-mwxg", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/40016", "name": "Fix: go-gitea/gitea pull request #40016", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40134", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40134", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.3.0/", "name": "Gitea 28.3.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "name": "go-gitea/gitea v28.3.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-01T09:48:55.849Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119533", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:09:21.844Z", "dateReserved": "2026-11-01T08:50:49.246Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-11-01T09:48:55.849Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "28.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests."}], "id": "CVE-2026-119533", "lastModified": "2026-11-06T16:17:52.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119533", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:08:46.983794Z", "version": "2.0.3"}}]}, "published": "2026-11-01T10:18:36.787", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-28.3.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40016"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40134"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Information disclosure via project boards referencing private pull requests", "id": "2564533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564533"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.", "A flaw was found in Gitea. Project boards do not properly verify read permissions when listing pull requests that reference board issues. An unauthorized user or anonymous visitor viewing an accessible board can see metadata from private pull requests, including repository paths, pull request numbers, titles, and states, resulting in information disclosure."], "name": "CVE-2026-119533", "public_date": "2026-11-01T09:48:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119533\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119533\nhttps://blog.gitea.com/release-of-28.3.0/\nhttps://github.com/go-gitea/gitea/pull/40016\nhttps://github.com/go-gitea/gitea/pull/40134\nhttps://github.com/go-gitea/gitea/releases/tag/v28.3.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg"], "statement": "This vulnerability is rated as Moderate because the scope of unauthorized access is limited to metadata such as pull request identifiers and titles, without exposing source code, diffs, or sensitive repository contents. Within Red Hat environments, affected components like Pipelines as Code merely consume Gitea Go libraries for client-side API integrations rather than hosting the interactive project board service. As a result, typical deployments of Red Hat products do not expose the vulnerable web functionality to end users.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,28.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea", "source": "cna", "vendor": "Gitea"}, "product": "gitea", "vendor": "gitea"}], "created": "2026-11-01T11:30:06.658306+00:00", "updated": "2026-11-06T18:15:07.325248+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea"]}