Information disclosure in Gitea - CVE-2026-73135
Published: August 31, 2026
Vulnerability identifier: #VU146361
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73135
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in repository listing endpoints when handling repository search, forks listing, or watched repository listing requests. A remote attacker can query these endpoints to disclose sensitive information.
The issue exposes repository metadata for repositories owned by hidden users, while direct routes to those repositories still return 404 responses.
Affected software
Gitea
How to mitigate CVE-2026-73135
Install security update from vendor's website.
Gitea - update to 1.27.3