CVEvulnerability

CVE-2026-68957

4.3 MEDIUM Published 2026-10-14 Modified 2026-10-14 Official page ↗
Status
Deferred
Published
2026-10-14
Last modified
2026-10-14
Assigner
88ee5874-cf24-4952-aea0-31affedb7ff2
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284

Description

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References