Gitea
CVE-2026-117649: The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependen
CVE-2026-117649 Nov 1, 2026 Source: Vendor
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names throu
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-117649
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
7 lines
Showing 1–7 of 7
CVE-2026-117649
BR2026-0000-040983
unclaimed
Credited as https://github.com/d3do-23
CVE-2026-117649
BR2026-0000-040984
unclaimed
Credited as https://github.com/kaveeshanirmal141
CVE-2026-117649
BR2026-0000-040985
unclaimed
Credited as https://github.com/manus-pi
CVE-2026-117649
BR2026-0000-040986
unclaimed
Credited as https://github.com/baek9
CVE-2026-117649
BR2026-0000-040987
unclaimed
Credited as https://github.com/bruhdev1290
CVE-2026-117649
BR2026-0000-040988
unclaimed
Credited as https://github.com/yagcioglutoprak
CVE-2026-117649
BR2026-0000-040989
unclaimed
Credited as https://github.com/lunny