CVE-2026-119533

EUVD-2026-114806

01.11.2026, 10:18

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Gitea	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 9.6%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
gitea	gitea	𝑥 < 28.3.0	CNA

Common Weakness Enumeration

CWE-862 - Missing Authorization
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

References

https://blog.gitea.com/release-of-28.3.0/

https://github.com/go-gitea/gitea/pull/40016

https://github.com/go-gitea/gitea/pull/40134

https://github.com/go-gitea/gitea/releases/tag/v28.3.0

https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg