CVE-2026-117649 Gitea CVE debrief

Who should care

Defenders of Gitea deployments, especially those with private repositories and issue tracking enabled, should assess exposure and prioritize verification and remediation. This includes reviewing deployment configurations, verifying exposure, and updating to version 28.3.0 or later. Security teams and vulnerability management teams should also review the potential impact on their assets and prioritize remediation efforts accordingly. Additionally, operators

Why it matters

CVE-2026-117649 is a metadata leak vulnerability in Gitea's issue timeline API and web issue page. Defenders should prioritize verifying exposure in Gitea deployments, especially those with private repositories and issue tracking enabled, and update to version 28.3.0 or later.

• Potential metadata leak through issue tracking API and web page
• Exposure of issue metadata for inaccessible issues
• Need for permission checks on dependency events
• Verification of Gitea version and deployment configuration

Technical summary

The issue timeline API and web issue page in Gitea hid cross-reference events pointing to inaccessible issues, potentially leaking metadata such as issue titles, bodies, states, labels, poster and attachment names. This vulnerability affects Gitea deployments, particularly those with private repositories and issue tracking enabled. Defenders should prioritize verifying exposure in Gitea deployments and update to version 28.3.0 or later to mitigate the vulnerability. The fix involves filtering dependency events with the same read permission check.

Defensive priority

Defenders should prioritize verifying exposure in Gitea deployments, especially those with private repositories and issue tracking enabled.

Recommended defensive actions

• Verify Gitea deployments for exposure, especially those with private repositories and issue tracking enabled
• Update Gitea to version 28.3.0 or later
• Monitor issue tracking and API usage for potential metadata leaks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue timeline API and web issue page in Gitea hid cross-reference events pointing to inaccessible issues, potentially leaking metadata. Dependency events are now filtered with the same read permission check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.