Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117649— Gitea private issue disclosure through issue dependency timeline events

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

问题时间线 API 和网页版问题详情页会隐藏指向读者无权访问的问题的交叉引用事件，但此前并未过滤“依赖关系已添加”和“依赖关系已移除”事件。当某个可读问题被链接为另一个读者无权访问的问题（例如私有仓库中的问题）的依赖项时，第一个问题的任何读者（包括公开仓库的匿名用户）均可通过 API 获取被链接问题的当前标题、正文、状态、标签、发布者及附件名称，并在网页上查看其所属仓库、编号和标题。创建此类链接需要同时具备对两个问题的访问权限；而被链接问题的评论和附件下载仍受到保护。现已对依赖关系事件实施与读取权限相同的过滤检查；

AI Predicted 6.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea < 28.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117649

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea private issue disclosure through issue dependency timeline events
Source: CVE Program / CVE List V5
Vulnerability Description
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 28.3.0 -

II. Public POCs for CVE-2026-117649

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117649

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-117649 (2)

Other References for CVE-2026-117649 (5)

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887 Gitea Actions task token private repository enumeration
CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
CVE-2026-116296 Gitea archived repository release, milestone and label modification
CVE-2026-116474 Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635 Gitea admin API public-only token scope bypass
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677 Gitea Helm chart upload decompression denial of service
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
CVE-2026-118504 Gitea issue changes on archived repositories through the API
CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533 Gitea private pull request disclosure on project boards
CVE-2026-119625 Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-200