Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119533— Gitea private pull request disclosure on project boards

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

仓库和组织的项目看板在列出引用各看板议题的拉取请求时，未检查查看者是否具备读取权限。当私有拉取请求提及了查看者可访问的看板议题时，若该看板为公开看板，则其会向匿名访客泄露私有仓库的路径以及拉取请求的编号、标题和状态。拉取请求的正文、差异（diff）和文件内容并未暴露。现在，看板会跳过那些查看者无权读取拉取请求的仓库中的关联拉取请求。

AI Predicted 5.3 Difficulty: Trivial Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1593 · Search Open Websites/Domains

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea private pull request disclosure on project boards

Source: CVE Program / CVE List V5

Vulnerability Description

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-119533

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119533

请登录查看更多情报信息。

Other References for CVE-2026-119533 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/40016 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg vendor-advisory
https://github.com/go-gitea/gitea/pull/40134 patch

https://www.cve.org/CVERecord?id=CVE-2026-119533

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117646		Gitea private repository listing to public-only tokens on profiles
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887		Gitea Actions task token private repository enumeration
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116296		Gitea archived repository release, milestone and label modification
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-117677		Gitea Helm chart upload decompression denial of service
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-118504		Gitea issue changes on archived repositories through the API
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea

Same weakness: CWE-862