CVE-2026-107618— Gitea cross-site request forgery on repository topics
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
接口在注册时未包含提供跨站请求保护（CSRF 防护）的登录中间件，因此第三方网站发起的请求未被拒绝。若仓库管理员访问了恶意页面，其仓库的主题（topics）可能被篡改。该路由无法访问仓库的其他任何设置。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107618
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea cross-site request forgery on repository topics
Source: CVE Program / CVE List V5
Vulnerability Description
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107618
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107618
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-107618 (2)
Vendor Advisories for CVE-2026-107618 (1)
Other References for CVE-2026-107618 (1)
-
https://blog.gitea.com/release-of-28.2.0/ release-notes
Same Patch Batch · Gitea · 2026-10-18 · 12 CVEs total
| CVE-2026-109553 | Gitea SSH certificate principal impersonation of other users | |
| CVE-2026-104627 | Gitea OpenID account linking without session binding | |
| CVE-2026-105661 | Gitea panic on the repositories route of individual users | |
| CVE-2026-105964 | Gitea Actions artifact v4 API unbounded request body | |
| CVE-2026-109844 | Gitea watched repositories API disclosure after access revocation | |
| CVE-2026-107686 | Gitea reactions accepted on locked issues and comments | |
| CVE-2026-110494 | Gitea release attachment re-linking of issue attachments | |
| CVE-2026-110324 | Gitea private profile information disclosure through POST request | |
| CVE-2026-110311 | Gitea draft release creation disclosing attachment metadata | |
| CVE-2026-97204 | Gitea label deletion across repository and organization IDs | |
| CVE-2026-97859 | Gitea API disclosure of private user social graph, keys and stars |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-97859
Gitea API disclosure of private user social graph, keys and -
CVE-2026-97204
Gitea label deletion across repository and organization IDs -
CVE-2026-110494
Gitea release attachment re-linking of issue attachments -
CVE-2026-110324
Gitea private profile information disclosure through POST re -
CVE-2026-110311
Gitea draft release creation disclosing attachment metadata
Same vendor: Gitea
-
CVE-2026-97859
Gitea API disclosure of private user social graph, keys and -
CVE-2026-97204
Gitea label deletion across repository and organization IDs -
CVE-2026-110494
Gitea release attachment re-linking of issue attachments -
CVE-2026-110324
Gitea private profile information disclosure through POST re -
CVE-2026-110311
Gitea draft release creation disclosing attachment metadata
V. Comments for CVE-2026-107618
No comments yet