Gitea
CVE-2026-119533: Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. Wh
CVE-2026-119533 Nov 1, 2026 Source: Vendor
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-119533
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-119533
BR2026-0000-041006
unclaimed
Credited as https://github.com/GrimTheRipper-SOSECURE
CVE-2026-119533
BR2026-0000-041007
unclaimed
Credited as https://github.com/bruhdev1290
CVE-2026-119533
BR2026-0000-041008
unclaimed
Credited as https://github.com/yagcioglutoprak
CVE-2026-119533
BR2026-0000-041009
unclaimed
Credited as https://github.com/lunny