CVE-2026-73135 Gitea hidden-owner repository listing disclosure
Attackers can view metadata of repositories owned by hidden users via inconsistent visibility checks in listing endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73135?
CVE-2026-73135 is a medium-severity vulnerability in Gitea, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
Weakness: CWE-200
Which versions are affected by CVE-2026-73135?
How do I fix CVE-2026-73135?
No fix has been published for CVE-2026-73135 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73135 being exploited?
There is no known exploitation of CVE-2026-73135 in the wild and no public exploit code.
Sources
Also known as GHSA-hch4-r2j8-xm72.