Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-117646— Gitea private repository listing to public-only tokens on profiles

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

用户资料页面中的“仓库”、“星标”和“关注”标签页，以及组织主页的仓库列表，在所有已登录的请求中均包含了私有仓库，且未检查该请求是否使用了仅限公开资源（）的个人访问令牌。持有此类令牌的攻击者可以列出该令牌所有者可见的私有仓库，以及该用户对私有仓库的星标和关注记录。API 接口和资料页面的“活动”标签页此前已实施了该限制。此次漏洞的影响范围仅限于仓库名称及元数据的泄露，不涉及仓库内容的暴露。

AI Predicted 6.5 Difficulty: Easy Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1087 · Account Discovery T1040 · Network Sniffing

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea private repository listing to public-only tokens on profiles

Source: CVE Program / CVE List V5

Vulnerability Description

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources (`public-only`). A holder of such a token could list the private repositories visible to the token's owner, and that user's stars and watches of private repositories. The API and the profile activity tab already applied the restriction. The impact is disclosure of repository names and metadata, not of repository content.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-117646

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117646

请登录查看更多情报信息。

Other References for CVE-2026-117646 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/39690 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-wxcq-p34j-7cjj vendor-advisory
https://github.com/go-gitea/gitea/pull/39853 patch

https://www.cve.org/CVERecord?id=CVE-2026-117646

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887		Gitea Actions task token private repository enumeration
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116296		Gitea archived repository release, milestone and label modification
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677		Gitea Helm chart upload decompression denial of service
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-118504		Gitea issue changes on archived repositories through the API
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533		Gitea private pull request disclosure on project boards
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea