{"api_version":"1","generated_at":"2026-11-02T12:46:28+00:00","cve":"CVE-2026-117649","urls":{"html":"https://cve.report/CVE-2026-117649","api":"https://cve.report/api/cve/CVE-2026-117649.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-117649","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-117649"},"summary":{"title":"Gitea private issue disclosure through issue dependency timeline events","description":"The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-01 10:18:35","updated_at":"2026-11-01 10:18:35"},"problem_types":["CWE-200","CWE-862","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-862 CWE-862: Missing Authorization"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/39847","name":"https://github.com/go-gitea/gitea/pull/39847","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.3.0/","name":"https://blog.gitea.com/release-of-28.3.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39942","name":"https://github.com/go-gitea/gitea/pull/39942","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40085","name":"https://github.com/go-gitea/gitea/pull/40085","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39839","name":"https://github.com/go-gitea/gitea/pull/39839","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-117649","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117649","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 28.3.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/d3do-23","lang":"en"},{"source":"CNA","value":"https://github.com/kaveeshanirmal141","lang":"en"},{"source":"CNA","value":"https://github.com/manus-pi","lang":"en"},{"source":"CNA","value":"https://github.com/baek9","lang":"en"},{"source":"CNA","value":"https://github.com/bruhdev1290","lang":"en"},{"source":"CNA","value":"https://github.com/yagcioglutoprak","lang":"en"},{"source":"CNA","value":"https://github.com/lunny","lang":"en"},{"source":"CNA","value":"https://github.com/bircni","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"117649","cve":"CVE-2026-117649","epss":"0.002210000","percentile":"0.127330000","score_date":"2026-11-01","updated_at":"2026-11-02 00:05:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.3.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/d3do-23"},{"lang":"en","type":"reporter","value":"https://github.com/kaveeshanirmal141"},{"lang":"en","type":"reporter","value":"https://github.com/manus-pi"},{"lang":"en","type":"reporter","value":"https://github.com/baek9"},{"lang":"en","type":"reporter","value":"https://github.com/bruhdev1290"},{"lang":"en","type":"reporter","value":"https://github.com/yagcioglutoprak"},{"lang":"en","type":"analyst","value":"https://github.com/lunny"},{"lang":"en","type":"remediation developer","value":"https://github.com/bircni"}],"descriptions":[{"lang":"en","value":"The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"},{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-01T09:48:43.592Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-p86q-78gw-8f3f","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p86q-78gw-8f3f"},{"name":"Fix: go-gitea/gitea pull request #39942","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39942"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40085","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40085"},{"name":"Related fix (hidden dependency attachments, 28.2.0): go-gitea/gitea pull request #39839","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39839"},{"name":"Related fix backport to release/v28 (28.2.0): go-gitea/gitea pull request #39847","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39847"},{"name":"Gitea 28.3.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.3.0/"},{"name":"go-gitea/gitea v28.3.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}],"title":"Gitea private issue disclosure through issue dependency timeline events"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-117649","datePublished":"2026-11-01T09:48:43.592Z","dateReserved":"2026-11-01T08:50:49.238Z","dateUpdated":"2026-11-01T09:48:43.592Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-01 10:18:35","lastModifiedDate":"2026-11-01 10:18:35","problem_types":["CWE-200","CWE-862","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-862 CWE-862: Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"117649","Ordinal":"1","Title":"Gitea private issue disclosure through issue dependency timeline","CVE":"CVE-2026-117649","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"117649","Ordinal":"1","NoteData":"The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not \"dependency added\" and \"dependency removed\" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.","Type":"Description","Title":"Gitea private issue disclosure through issue dependency timeline"}]}}}