CVE-2026-119533
Gitea private pull request disclosure on project boards
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.
| CWE | CWE-862 |
| Vendor | gitea |
| Product | gitea |
| Published | Nov 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 < 28.3.0
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg github.com: https://github.com/go-gitea/gitea/pull/40016 github.com: https://github.com/go-gitea/gitea/pull/40134 blog.gitea.com: https://blog.gitea.com/release-of-28.3.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.3.0
Credits
🔍 https://github.com/GrimTheRipper-SOSECURE 🔍 https://github.com/bruhdev1290 🔍 https://github.com/yagcioglutoprak https://github.com/lunny https://github.com/basavaraj-sm05