CVE-2026-73135

Deferred Deferred - Pending Action

Gitea Repository Visibility Exposure via Inconsistent Predicates

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73135

EUVD

EUVD-2026-101102

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-73135 is a vulnerability in Gitea where repository visibility rules are inconsistently applied. Public repositories owned by hidden user accounts are incorrectly included in broad repository listings, even though direct access to these repositories returns a 404 error. This allows unauthorized users to enumerate repository existence and metadata through search or forks listings.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version prior to 1.27.3. Use commands like 'gitea --version' or check the web interface under 'Site Administration' > 'System Information'. Verify if public repositories owned by hidden users appear in broad listings such as search or forks endpoints.

Impact Analysis

This vulnerability may expose sensitive repository information to unauthorized users. Attackers could discover hidden repositories through search or forks listings, potentially revealing metadata like repository names, owners, or existence. This could lead to further targeted attacks or information leaks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing repository metadata of hidden user accounts. Unauthorized enumeration of sensitive repository information may lead to unintended disclosure of personal or confidential data, violating data protection principles under GDPR and HIPAA requirements for safeguarding sensitive information.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. This can be done by downloading the latest release from the official Gitea website or using your package manager. Ensure automatic updates are enabled if using Gitea Cloud to avoid manual intervention.

Hi! I’m here to help you understand CVE-2026-73135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70