CVE-2026-73126

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
GiteaGitea<= 1.27.2

References

Timeline

Published
Oct 14, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-73134.9CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authCVE-2026-731304.3Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits CVE-2026-731355.3Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whCVE-2026-731367.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfeCVE-2026-731377.7A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmReleasCVE-2026-73147.3A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/apCVE-2026-731405.3Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normCVE-2026-73157.3A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.pyCVE-2026-731555.3Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether thoCVE-2026-731565.3Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. SCVE-2026-731572.3Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolatioCVE-2026-731585.1Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties