Gitea pull request disclosure to members with access to issues only
Summary
| CVE | CVE-2026-129525 |
|---|---|
| State | PUBLISHED |
| Assigner | Gitea |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-15 22:17:19 UTC |
| Updated | 2026-11-15 22:17:19 UTC |
| Description | Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository's issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository's issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0. |
Risk And Classification
Problem Types: CWE-862 | CWE-862 CWE-862: Missing Authorization
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/go-gitea/gitea/pull/39847 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/releases/tag/v28.4.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39885 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/security/advisories/GHSA-qrrc-h266-v49p | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/40192 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39938 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| blog.gitea.com/release-of-28.4.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | blog.gitea.com | |
| github.com/go-gitea/gitea/pull/40375 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39839 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: https://github.com/hexcraft-labs (en)
CNA: https://github.com/d3do-23 (en)
CNA: https://github.com/takumi142857-git (en)
CNA: https://github.com/N0K0 (en)
CNA: https://github.com/zzy13051013697 (en)
CNA: https://github.com/HexDump0 (en)
CNA: https://github.com/123abab123789 (en)
CNA: https://github.com/basavaraj-sm05 (en)
CNA: https://github.com/silverwind (en)
There are currently no legacy QID mappings associated with this CVE.