CVE-2026-71301

Deferred Deferred - Pending Action

Gitea Pull Request Metadata Exposure via Markup Endpoint

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite lacking Issues and Pull Requests access. This exposes pull request metadata across repository unit permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-71301

EUVD

EUVD-2026-101099

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a user with only Wiki access to a private repository to view metadata like titles and state icons of private pull requests within the same repository. The issue occurs because the markup endpoint does not enforce Pull Requests permission checks when resolving same-repository references.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version prior to 1.27.3. Use commands like 'gitea --version' or check the web interface version info. Inspect logs for unauthorized markup preview requests referencing pull requests in private repositories.

Impact Analysis

An attacker with limited repository access could exploit this to gather sensitive information about private pull requests, such as their existence, titles, or status. This could aid in further attacks or information gathering without needing broader repository permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to private pull request metadata, potentially violating data protection requirements under GDPR or HIPAA by exposing sensitive information without proper authorization.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. There are no workarounds; upgrading is the only mitigation. Verify the upgrade by checking the version and testing access controls for pull request visibility.

Hi! I’m here to help you understand CVE-2026-71301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70