CVE-2026-107618

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-18

Last updated on: 2026-10-29

Assigner: Gitea Limited

Description

`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-107618

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing sign-in middleware on the POST /{owner}/{repo}/topics endpoint. Without this protection, a third-party site could send requests to change repository topics. Only repository administrators who visit a malicious page are affected, and only the topics of their repository can be modified through this route.

Detection Guidance

This vulnerability involves a missing sign-in middleware on a POST endpoint for repository topics in Gitea. To detect it, check Gitea server logs for unauthorized POST requests to /{owner}/{repo}/topics. Look for requests originating from third-party sites without valid session cookies.

Impact Analysis

If you are a repository administrator, visiting a malicious page could allow an attacker to change the topics of your repository without your consent. This could mislead users or disrupt repository organization, but no other settings are affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves unauthorized modification of repository topics by a third-party site without sign-in protection. No evidence suggests exposure of personal or sensitive data.

Mitigation Strategies

Update Gitea to the latest version to ensure the sign-in middleware is applied to the /{owner}/{repo}/topics endpoint. Review repository access logs for unauthorized topic changes.

Hi! I’m here to help you understand CVE-2026-107618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...