Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123009— Gitea base repository code disclosure through the web editor in forks

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当通过网页编辑器在复刻仓库中编辑文件时，Gitea首先会从基础仓库复制一个分支到复刻仓库中。该复制操作未检查用户是否有权读取基础仓库的代码。一个曾复刻过某仓库、但后来失去访问权限的用户（例如该仓库被设为私有，或该用户被移除协作者身份），仍可以持续将其当前分支复制到自己的复刻仓库中并进行阅读。现在该复制操作要求对基础仓库的代码具有读取权限。

AI Predicted 6.5 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123009

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea base repository code disclosure through the web editor in forks
Source: CVE Program / CVE List V5
Vulnerability Description
When a file is edited in a fork through the web editor, Gitea can first copy a branch from the base repository into the fork. That copy did not check whether the user may read the base repository's code. A user who had forked a repository and later lost access to it, for example after it was made private or they were removed as a collaborator, could keep copying its current branches into their fork and read them. The copy now requires read access to the code of the base repository.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 1.25.0 ~ 28.4.0 -

II. Public POCs for CVE-2026-123009

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123009

请登录查看更多情报信息。

Other References for CVE-2026-123009 (5)

Same Patch Batch · Gitea · 2026-11-15 · 20 CVEs total

CVE-2026-123638 Gitea protected file pattern bypass with quoted file names
CVE-2026-123006 Gitea password hash disclosure through repository search
CVE-2026-125423 Gitea command execution through repository auto-initialization
CVE-2026-118389 Gitea RubyGems compact index injection through package metadata
CVE-2026-118535 Gitea scoped workflow trust kept after repository transfer
CVE-2026-120725 Gitea anonymous Git LFS access despite required sign-in
CVE-2026-120729 Gitea stored cross-site scripting in the issue reference popup
CVE-2026-120991 Gitea deletion of shared container blobs on rejected uploads
CVE-2026-123002 Gitea missing attempt limit for TOTP passcodes
CVE-2026-123065 Gitea deletion of arbitrary attachment files through release edit
CVE-2026-129525 Gitea pull request disclosure to members with access to issues only
CVE-2026-123642 Gitea pull request creation without pull request access through AGit
CVE-2026-125617 Gitea hidden organization membership disclosure through the permissions API
CVE-2026-126338 Gitea private diff disclosure through code comment replies
CVE-2026-127958 Gitea disclosure of pending pull request reviews created through the API
CVE-2026-128359 Gitea OAuth2 provider tokens issued to disabled users
CVE-2026-128365 Gitea required approval bypass through team review request removal
CVE-2026-129337 Gitea push without write access to repositories still being created
CVE-2026-129341 Gitea release asset deletion by former writers

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-284