CVE-2026-119533
Description
A flaw was found in Gitea. Project boards do not properly verify read permissions when listing pull requests that reference board issues. An unauthorized user or anonymous visitor viewing an accessible board can see metadata from private pull requests, including repository paths, pull request numbers, titles, and states, resulting in information disclosure.
Statement
This vulnerability is rated as Moderate because the scope of unauthorized access is limited to metadata such as pull request identifiers and titles, without exposing source code, diffs, or sensitive repository contents. Within Red Hat environments, affected components like Pipelines as Code merely consume Gitea Go libraries for client-side API integrations rather than hosting the interactive project board service. As a result, typical deployments of Red Hat products do not expose the vulnerable web functionality to end users.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
