154 matches found
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57897
A flaw in Gitea allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job APIs . An attacker could exploit this vulnerability to gain unauthorized access to sensitive information across different repositories. To mitigate this risk, you can globally disable G...
CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-57886
The Git repository management system Gitea is vulnerable to a cross-repository issue where re-linking issue or comment attachments can expose private attachment content. The root cause lies in the UpdateIssueAttachments() function (in models/issues/issue_update.go) and the UpdateCommentAttachment...
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content...
EUVD-2026-58147
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-58445: Observable Discrepancy
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...
CVE-2026-57886: Authorization Bypass Through User-Controlled Key
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-58438: Missing Authorization
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
SUSE CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...
EUVD-2026-49573
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
GO-2026-6067 Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...
GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...
GO-2026-6060 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea...
PT-2026-65365
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...