CVE-2026-73135

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Gitea	Gitea	<= 1.27.1

References

Timeline

Published: Oct 14, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-731367.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfe CVE-2026-731377.7A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmReleas CVE-2026-73147.3A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/ap CVE-2026-731405.3Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although norm CVE-2026-73157.3A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.py CVE-2026-731555.3Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether tho CVE-2026-731565.3Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. S CVE-2026-731572.3Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolatio CVE-2026-731585.1Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties CVE-2026-731595.1Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper m CVE-2026-73167.3A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of CVE-2026-731608.7Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL valid