Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 01 Nov 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests. | |
| Title | Gitea private pull request disclosure on project boards | |
| Weaknesses | CWE-862 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-01T09:48:55.849Z
Reserved: 2026-11-01T08:50:49.246Z
Link: CVE-2026-119533
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-01T10:18:36.787
Modified: 2026-11-01T10:18:36.897
Link: CVE-2026-119533
Redhat
No data.
OpenCVE Enrichment
No data.