CVE-2026-110624

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-73135

Gitea is vulnerable to a repository listing disclosure due to inconsistent repository visibility predicates. Specifically, the accessible-repository condition treats repositories owned by hidden users differently than other predicates. This allows some repository-listing endpoints to disclose rep...

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-68964

The Gitea platform is vulnerable to a metadata disclosure vulnerability because the user SSH and GPG key-list API endpoints omit the profile visibility checks applied to web equivalents. An authenticated account with restricted status can access public keys, key titles, fingerprints, and GPG-embe...

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-68964

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853

The Gitea user organization-list API fails to apply visibility restrictions for authenticated restricted accounts, allowing them to enumerate Limited-visibility organizations . A restricted user can list a known user's public organization memberships via the GET /api/v1/users/{username}/orgs endp...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-59766

The Git repository management system Gitea is vulnerable to an access control deficiency in its starred-repository and tracked-time API endpoints. Specifically, the getStarredRepos() function in routers/api/v1/user/star.go and the ListMyTrackedTimes() function in routers/api/v1/repo/issue_tracked...

CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

EUVD-2026-101252

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-110624 Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-110624

Papermerge Core versions through 3.5.3 are vulnerable to a missing authorization flaw (CWE-862). The issue exists because the GET /tags/all and GET /document-types/all endpoints fail to perform the necessary user_belongs_to check when a group_id parameter is supplied. Consequently, authenticated ...

CVE-2026-110624 Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-108388

The event management system Indico versions 3.3.3 through 3.3.13 is vulnerable to a cache poisoning issue. The software incorrectly utilizes the ambient web-session user instead of the specific user provided to Contribution.can_manage when verifying inherited event contribution-management permiss...

CVE-2026-102663

Prior to version 4.2.4 , OpenList is vulnerable to unauthorized disclosure of file metadata and existence information due to a non-separator-aware path check in the search API. When Bleve search is enabled, an authenticated user with restricted access can exploit a flawed strings.HasPrefix compar...