CVE-2026-129525
Deferred
Deferred - Pending Action
Information Disclosure in GitLab API Endpoints
Vulnerability report for CVE-2026-129525, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-15
Last updated on: 2026-11-15
Assigner: Gitea Limited
Description
Description
Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository's issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository's issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
