MEDIUM 5.3 NVD
CVE-2026-73135
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidde
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
References
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39009
- https://github.com/go-gitea/gitea/pull/39012
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-14 via NVD.
vulnfeed aggregates 14864 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.