CVE-2026-119533 Gitea CVE debrief

Who should care

Gitea administrators and users with private repositories and pull requests on public boards should verify their exposure and assess the impact of the vulnerability. Defenders should prioritize verifying exposure in Gitea deployments, especially for public boards with private pull requests. This includes reviewing Gitea logs for potential exploitation attempts and assessing potential unauthorized access to private repository paths and pull request details.

Why it matters

CVE-2026-119533 allows anonymous visitors to see private repository paths and pull request details on public boards. Defenders should prioritize verifying exposure in Gitea deployments, especially for public boards with private pull requests.

• Verify exposure of private repositories and pull requests on public boards
• Assess potential unauthorized access to private repository paths and pull request details
• Review Gitea logs for potential exploitation attempts

Technical summary

The vulnerability allows anonymous visitors to see private repository paths and pull request details on public boards. The fix skips linked pull requests in repositories where the viewer cannot read pull requests. This issue affects Gitea deployments with public boards and private pull requests. Defenders should prioritize verifying exposure in Gitea deployments, especially for public boards with private pull requests. The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the scope of affected Gitea deployments and to confirm the details of the fix.

Defensive priority

Defenders should prioritize verifying exposure in Gitea deployments, especially for public boards with private pull requests.

Recommended defensive actions

• Verify Gitea deployments for exposure to public boards with private pull requests
• Assess the impact of the vulnerability on private repositories and pull requests
• Review Gitea logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the scope of affected Gitea deployments and to confirm the details of the fix. The vulnerability allows anonymous visitors to see private repository paths and pull request details on public boards. The fix skips linked pull requests in repositories where the viewer cannot read pull requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.