22 matches found
CVE-2026-117649
A flaw was found in Gitea. This vulnerability leads to unauthorized information disclosure due to missing access control checks on issue dependency events in the web interface and application programming interface API. If an accessible issue is linked to an issue in a restricted or private...
CVE-2026-117649
The Gitea issue timeline API and web issue page are vulnerable to information disclosure due to improper filtering of "dependency added" and "dependency removed" events. When a readable issue is linked as a dependency to an issue in a restricted repository (e.g., a private one), unauthorized user...
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Platform members can delete owner issue dependencies through member-owned related issues Summarypraisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but c...
CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...
CVE-2026-62179
In praisonai-platform prior to version 0.1.9 , a vulnerability exists where workspace members can delete owner-created issue dependencies. The root cause is an incorrect authorization flaw where the system checks permissions against the caller-selected URL issue instead of verifying the owner's p...
CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...
CVE-2026-62179
PraisonAI is a multi-agent teams system. In "praisonai-platform" prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same...
CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...
GHSA-MXMX-RH57-JX58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...
CVE-2026-58438
A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference IDOR, exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private...
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
EUVD-2026-58165
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438
The Git repository management system Gitea is vulnerable to a cross-repository IDOR (Insecure Direct Object Reference) in the issue-dependency removal functionality. This flaw allows a malicious actor to tamper with and comment on private repositories they are not authorized to access. A proof-of...
CVE-2026-58438: Missing Authorization
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...
