CVE-2026-73135 Gitea CVE debrief

Who should care

Gitea instance administrators and defenders should assess exposure to this issue, especially those with hidden repository owners, and prioritize verifying potential repository metadata disclosure.

Why it matters

Defenders should prioritize verifying exposure of Gitea instances to this issue, especially those with hidden repository owners, and assess the impact of potential repository metadata disclosure. This issue may lead to unintended disclosure of repository metadata, and defenders should review and update Gitea instance configurations to prevent such disclosure.

• Potential disclosure of repository metadata for repositories with hidden owners
• Unintended exposure of repository existence and listing information
• Need for verification of Gitea instance configurations to prevent metadata disclosure
• Possible impact on Gitea instance security and data confidentiality

Technical summary

The issue arises from Gitea's inconsistent repository visibility predicates, which allow some repository-listing endpoints to disclose repository metadata even when the repository owner is hidden from the viewer. This occurs because the conditions used by these endpoints do not properly respect the visibility settings of repository owners. As a result, defenders may unintentionally expose repository existence and listing information across the intended owner-visibility boundary. Gitea instance administrators should prioritize verifying exposure to this issue, especially those with hidden repository owners, and assess the impact of potential repository metadata disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to this issue, especially those with hidden repository owners, and assess the impact of potential repository metadata disclosure.

Recommended defensive actions

• Verify Gitea instance exposure to this issue, especially for hidden repository owners
• Assess potential repository metadata disclosure impact
• Review and update Gitea instance configurations to prevent unintended metadata disclosure
• Monitor Gitea instance logs for potential exploitation attempts
• Perform an asset inventory to identify potentially affected Gitea instances
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the inconsistent repository visibility predicates in Gitea, which could lead to unintended disclosure of repository metadata. Defenders should verify potential exposure, especially for hidden repository owners, and assess the impact of potential repository metadata disclosure. Evidence from the CVE Program and NVD detail page supports this assessment. Verification tasks should include reviewing Gitea instance configurations and monitoring for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.