CVE-2026-117649 Details
Description
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.
A vulnerability in Gitea's issue timeline and cross-repository dependency management has been identified, which allows for the unauthorized exposure of private issue details. This issue affects Gitea versions through 28.2.0. When a public issue is linked to a private issue as a dependency, users can inadvertently access the private issue's title, body, and certain attachment metadata, even if they lack permission to view the private repository. This vulnerability arises because the dependency read process does not properly enforce access controls, failing to filter out sensitive information from private issues while still safeguarding comments and attachments. The issue has been acknowledged and addressed in Gitea version 28.3.0.
Users can upgrade to Gitea version 28.3.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39839 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39847 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39942 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/40085 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Gitea Limited |
| CWE-862 | Missing Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |