CVE-2026-119533 Details
Description
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.
A vulnerability in Gitea project boards allows for the unintentional disclosure of private pull request details to users who cannot access them. This issue occurs when a private pull request references a public issue on a project board that the user can open. In such cases, the board reveals the private repository's path, along with the pull request's number, title, and state, to anonymous visitors on public boards. The vulnerability is present in Gitea versions through 28.2.0 and has been patched in version 28.3.0.
Users can upgrade to Gitea version 28.3.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/40016 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/40134 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |