CVE-2026-117649
Deferred Deferred - Pending Action

Information Exposure in GitLab Issue Dependency Events

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-117649

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-117649 is a vulnerability in Gitea where issue dependencies and timeline APIs expose private issue details without proper access checks. When a public issue links to a private issue as a dependency, unauthorized users can view the private issue's title, body, state, labels, poster, and attachment names through the API or web page. Dependency events were not filtered by read permissions, allowing sensitive data leaks.

Detection Guidance

This vulnerability involves unauthorized exposure of private issue data through dependency links. To detect it, inspect Gitea API responses for issue dependencies pointing to inaccessible repositories. Check logs for unauthorized access attempts to issue endpoints or timeline APIs. Ensure your Gitea instance is updated to version 28.3.0 or later to mitigate the issue.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive information from private repositories if they can view a linked public issue. Attackers could extract issue titles, bodies, labels, and attachment metadata without proper permissions. The exposure includes instance-wide attachment filenames and UUIDs for unlinked uploads, even for users without access.

Compliance Impact

This vulnerability may violate compliance requirements by exposing private repository data to unauthorized users. GDPR and HIPAA mandate strict access controls and data protection; unauthorized exposure of issue details and attachments could lead to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later to apply the necessary permission checks and fixes for dependency issue exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...