CVE-2026-114075 Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...

CVE-2026-114075

Versions of Trigger.dev before 4.5.12 are vulnerable to an authorization bypass (CWE-863) via the Alert Channels API . This flaw allows holders of capability-restricted user-actor tokens to utilize the legacy personal access token helper to create alert channels. Specifically, an attacker with a ...

CVE-2026-114075 Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...

CVE-2026-114075 Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-68957

The Gitea issue-search API and web paths contain an access control vulnerability where restricted accounts are not correctly treated as anonymous viewers. This allows restricted users to search and retrieve issue titles and bodies from Limited-visibility repository owners that should be hidden by...

CVE-2026-68957 Gitea restricted-user issue search disclosure

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also...

CVE-2026-68957 Gitea restricted-user issue search disclosure

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also...

CVE-2026-68957 Gitea restricted-user issue search disclosure

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also...

CVE-2026-67577 Gitea restricted-user activity and heatmap disclosure

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66849

The Gitea package registry contains an Improper Access Control vulnerability (CWE-284 ) where authenticated users can gain read access to packages owned by Limited-visibility users. The root cause is a failure to exclude restricted accounts from the package-registry access check, allowing restric...

CVE-2026-66849 Gitea restricted-user package visibility bypass

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects...

CVE-2026-66849

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-68957): Gitea -- multiple vulnerabilities

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also...

Payload: Token refresh and password reset responses may expose restricted user fields

Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. Patches Authentication responses now apply field access and hidden-field filtering...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...