CVE-2026-119533 Gitea private pull request disclosure on project boards
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119533?
CVE-2026-119533 is a high-severity vulnerability in Gitea, published on 1 Nov 2026.
Official description
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.
Weakness: CWE-862
Which versions are affected by CVE-2026-119533?
How do I fix CVE-2026-119533?
No fix has been published for CVE-2026-119533 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119533 being exploited?
There is no known exploitation of CVE-2026-119533 in the wild and no public exploit code.
Sources
Also known as GHSA-c45m-jm46-mwxg.