CVE-2026-123006
Deferred Deferred - Pending Action

GitLab Dashboard Exposes User Password Hashes via Commit Status

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Gitea Limited

Description
The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner's full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-123006
EUVD
EUVD-2026-126114

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea From 28.0.0 (inc) to 28.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea versions 28.0.0 through 28.3.0 allowed any authenticated user to access sensitive password hash details, including the hash, salt, and primary email address of repository owners. The issue occurred because the repository search endpoint returned the full internal commit status object, exposing the owner's user record.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running versions 28.0.0 through 28.3.0. Verify if the /repo/search endpoint exposes sensitive user data by inspecting API responses for password hashes, salts, or email addresses in commit status objects.

Impact Analysis

Attackers could harvest password hashes for offline cracking attempts and perform account enumeration. This compromises user accounts, leading to potential unauthorized access, data breaches, and loss of confidentiality and integrity of user data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data like email addresses and password hashes. It exposes organizations to legal penalties, reputational damage, and increased scrutiny for failing to protect sensitive user information.

Mitigation Strategies

Upgrade Gitea to version 28.4.0 or later immediately. This version patches the issue by restricting the /repo/search endpoint to only return the state and target URL of commit statuses, preventing exposure of sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...