CVE-2026-123006

The Gitea repository search functionality via the GET /repo/search endpoint contains a vulnerability where it exposed internal commit status objects. Since version 28.0.0 , these objects included the repository owner's full user record. Consequently, any authenticated user could access the passwo...