CVE-2026-119533

{"id": "CVE-2026-119533", "cveTags": [], "metrics": {}, "affected": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "affectedData": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "lessThan": "28.3.0", "versionType": "semver"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}]}], "published": "2026-11-01T10:18:36.787", "references": [{"url": "https://blog.gitea.com/release-of-28.3.0/", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/40016", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/40134", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests."}], "lastModified": "2026-11-01T10:18:36.897", "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2"}