CVE-2026-117649
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.
- Score
- –
- Published
- 2026-11-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| www/gitea | gitea | 28.2.0 | unaddressed | ports@foss-daily.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>gitea -- FIXME</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>28.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-117649: The issue timeline API and the web issue page hid
cross-reference events that point at issues the reader cannot
access, but not "dependency added" and "dependency removed" events.
When a readable issue had been linked as a dependency to an issue
in a repository the reader cannot access, for example a private
repository, any reader of the first issue, including anonymous
users of a public repository, received the linked issue's current
title, body, state, labels, poster and attachment names through the
API, and its repository, number and title on the web page. Creating
the link requires access to both issues; comments and attachment
downloads of the linked issue stayed protected. Dependency events
are now filtered with the same read permission check; a related
exposure of unlinked attachment metadata through hidden dependency
placeholders was already fixed in 28.2.0.</p>
</body>
</description>
<references>
<cvename>CVE-2026-117649</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-117649</url>
</references>
<dates>
<discovery>2026-11-01</discovery>
<entry>2026-11-02</entry>
</dates>
</vuln>