CVE-2026-107618

Received Received - Intake

Cross-Site Request Forgery in GitHub Repository Topics

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-107618

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing sign-in middleware on the POST /{owner}/{repo}/topics endpoint. Without this protection, a third-party site could send requests to change repository topics. Only repository administrators who visit a malicious page are affected, and only the topics of their repository can be modified through this route.

Detection Guidance

This vulnerability involves a missing sign-in middleware on a POST endpoint for repository topics in Gitea. To detect it, check Gitea server logs for unauthorized POST requests to /{owner}/{repo}/topics. Look for requests originating from third-party sites without valid session cookies.

Impact Analysis

If you are a repository administrator, visiting a malicious page could allow an attacker to change the topics of your repository without your consent. This could mislead users or disrupt repository organization, but no other settings are affected.

Mitigation Strategies

Update Gitea to the latest version to ensure the sign-in middleware is applied to the /{owner}/{repo}/topics endpoint. Review repository access logs for unauthorized topic changes.

Hi! I’m here to help you understand CVE-2026-107618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70