CVE-2026-117649
Description
A flaw was found in Gitea. This vulnerability leads to unauthorized information disclosure due to missing access control checks on issue dependency events in the web interface and application programming interface (API). If an accessible issue is linked to an issue in a restricted or private repository, any reader—including unauthenticated users on public repositories—can view details from the private issue. Exposed information includes the restricted issue's title, description, state, labels, author, and attachment names.
Statement
This vulnerability is rated Moderate severity for Red Hat because the impact is restricted to partial metadata leakage rather than arbitrary code execution, privilege escalation, or unauthorized modification of data. Red Hat offerings typically integrate Gitea client modules for automation pipelines rather than deploying the full web issue tracker, minimizing attack surface across typical environments. Furthermore, triggering this leak requires that an authorized collaborator had previously established a cross-repository dependency link between a restricted item and a publicly viewable issue.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
