Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 01 Nov 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests. | |
| Title | Gitea private pull request disclosure on project boards | |
| Weaknesses | CWE-862 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-01T09:48:55.849Z
Reserved: 2026-11-01T08:50:49.246Z
Link: CVE-2026-119533
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-01T10:18:36.787
Modified: 2026-11-01T10:18:36.897
Link: CVE-2026-119533
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-01T11:30:06Z
Weaknesses