{"api_version":"1","generated_at":"2026-11-15T23:52:25+00:00","cve":"CVE-2026-129525","urls":{"html":"https://cve.report/CVE-2026-129525","api":"https://cve.report/api/cve/CVE-2026-129525.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-129525","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-129525"},"summary":{"title":"Gitea pull request disclosure to members with access to issues only","description":"Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository's issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository's issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:19","updated_at":"2026-11-15 22:17:19"},"problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/39847","name":"https://github.com/go-gitea/gitea/pull/39847","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39885","name":"https://github.com/go-gitea/gitea/pull/39885","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qrrc-h266-v49p","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qrrc-h266-v49p","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40192","name":"https://github.com/go-gitea/gitea/pull/40192","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39938","name":"https://github.com/go-gitea/gitea/pull/39938","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40375","name":"https://github.com/go-gitea/gitea/pull/40375","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39839","name":"https://github.com/go-gitea/gitea/pull/39839","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-129525","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129525","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 28.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/hexcraft-labs","lang":"en"},{"source":"CNA","value":"https://github.com/d3do-23","lang":"en"},{"source":"CNA","value":"https://github.com/takumi142857-git","lang":"en"},{"source":"CNA","value":"https://github.com/N0K0","lang":"en"},{"source":"CNA","value":"https://github.com/zzy13051013697","lang":"en"},{"source":"CNA","value":"https://github.com/HexDump0","lang":"en"},{"source":"CNA","value":"https://github.com/123abab123789","lang":"en"},{"source":"CNA","value":"https://github.com/basavaraj-sm05","lang":"en"},{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.4.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/hexcraft-labs"},{"lang":"en","type":"reporter","value":"https://github.com/d3do-23"},{"lang":"en","type":"reporter","value":"https://github.com/takumi142857-git"},{"lang":"en","type":"reporter","value":"https://github.com/N0K0"},{"lang":"en","type":"reporter","value":"https://github.com/zzy13051013697"},{"lang":"en","type":"reporter","value":"https://github.com/HexDump0"},{"lang":"en","type":"reporter","value":"https://github.com/123abab123789"},{"lang":"en","type":"remediation developer","value":"https://github.com/basavaraj-sm05"},{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository's issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository's issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:14:21.406Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-qrrc-h266-v49p","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qrrc-h266-v49p"},{"name":"Fix: go-gitea/gitea pull request #39839","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39839"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #39847","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39847"},{"name":"Fix: go-gitea/gitea pull request #39885","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39885"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #39938","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39938"},{"name":"Fix: go-gitea/gitea pull request #40192","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40192"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40375","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40375"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.4.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}],"title":"Gitea pull request disclosure to members with access to issues only"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-129525","datePublished":"2026-11-15T21:14:21.406Z","dateReserved":"2026-11-15T20:31:51.047Z","dateUpdated":"2026-11-15T21:14:21.406Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:19","lastModifiedDate":"2026-11-15 22:17:19","problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"129525","Ordinal":"1","Title":"Gitea pull request disclosure to members with access to issues o","CVE":"CVE-2026-129525","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"129525","Ordinal":"1","NoteData":"Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository's issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository's issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0.","Type":"Description","Title":"Gitea pull request disclosure to members with access to issues o"}]}}}