CVE-2026-117646 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, particularly those with private repositories, should assess exposure and verify the impact of metadata disclosure. This includes reviewing and updating access controls, monitoring for potential exploitation attempts, and implementing additional security measures to protect private repositories. Gitea instance administrators and security teams should prioritize verifying exposure of private repositories and assess

Why it matters

CVE-2026-117646 is a metadata disclosure vulnerability in Gitea instances. Defenders should verify exposure of private repositories and assess the impact of metadata disclosure. Further verification is required to determine the scope of affected systems and potential impact.

• Potential disclosure of private repository metadata
• Need to verify exposure of private repositories to unauthorized access
• Possible impact on Gitea instance security posture
• Requires review and update of access controls

Technical summary

The Gitea API and profile activity tab did not properly restrict access to private repositories for users with personal access tokens limited to public resources. This could allow unauthorized access to private repository names and metadata. The vulnerability affects Gitea instances with private repositories and involves metadata disclosure. Defenders should prioritize verifying exposure of private repositories and assessing the impact of metadata disclosure. The CVE record and NVD entry provide limited information, and further verification is required to determine the scope of affected systems and potential impact.

Defensive priority

Defenders should prioritize verifying exposure of private repositories and assessing the impact of metadata disclosure.

Recommended defensive actions

• Verify exposure of private repositories to unauthorized access
• Assess the impact of metadata disclosure on private repositories
• Review and update access controls for Gitea instances
• Monitor for potential exploitation attempts
• Perform a thorough review of Gitea instance configurations
• Update Gitea instances to the latest version
• Implement additional security measures to protect private repositories

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the scope of affected systems and potential impact. The vulnerability involves metadata disclosure in Gitea instances, particularly those with private repositories. Defenders should verify exposure of private repositories and assess the impact of metadata disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.