CVE-2026-107618 Gitea CVE debrief

Who should care

Repository administrators and Gitea users should be aware of this vulnerability and take steps to prevent unauthorized topic changes. They should verify Gitea version and apply patches to prevent unauthorized topic changes. Additionally, they should monitor repository topic changes for suspicious activity and restrict repository administrator access to sensitive pages.

Why it matters

The Gitea cross-site request forgery vulnerability allows attackers to change repository topics, potentially leading to security incidents. Repository administrators should verify and apply patches to prevent unauthorized topic changes.

• attackers can change repository topics without administrator knowledge
• Repository administrators may need to verify topic changes for suspicious activity
• Gitea users may need to monitor repository activity for potential security incidents

Technical summary

The Gitea cross-site request forgery vulnerability allows an attacker to change repository topics when a repository administrator visits a malicious page. The vulnerability exists because the `POST /{owner}/{repo}/topics` endpoint was registered without the sign-in middleware that provides cross-origin protection. This oversight enables attackers to modify repository topics without administrator knowledge, potentially leading to security incidents. Repository administrators should verify and apply patches to prevent unauthorized topic changes.

Defensive priority

Repository administrators should verify and apply patches to prevent unauthorized topic changes.

Recommended defensive actions

• Verify Gitea version and apply patches to prevent unauthorized topic changes
• Monitor repository topic changes for suspicious activity
• Restrict repository administrator access to sensitive pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the cross-site request forgery vulnerability in Gitea, which allows attackers to change repository topics. The vulnerability is caused by the lack of sign-in middleware on the `POST /{owner}/{repo}/topics` endpoint, providing cross-origin protection. Repository administrators should verify and apply patches to prevent unauthorized topic changes. Evidence is limited to CVE records and source items, and defenders should verify affected scope and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.