CVE-2026-119533

Gitea private pull request disclosure on project boards

State: Published
Severity: Not scored
Published: Nov 1, 2026
Updated: Nov 1, 2026
Reserved: Nov 1, 2026

Description

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.

Scores

The record has no CVSS score.

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
GiteaGitea	before 28.3.0Affected

References

GitHub Security Advisory GHSA-c45m-jm46-mwxgvendor-advisory
Fix: go-gitea/gitea pull request #40016patch
Fix backport to release/v28: go-gitea/gitea pull request #40134patch
Gitea 28.3.0 release announcementrelease-notes
go-gitea/gitea v28.3.0 releaserelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.