CVE and update status of the FreeBSD ports tree3,755 unaddressed CVEs in 720 portsAll times are CET
CVE details

CVE-2026-117685

The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope, whose owner can read a private package and write to a public package namespace, could mount a blob of the private package into the public package. The private blob, such as a container layer, could then be downloaded by anyone through the public package.

Score
–
Published
2026-11-01
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/giteagitea28.2.0unaddressedports@foss-daily.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>gitea -- FIXME</topic>
    <affects>
      <package>
	<name>gitea</name>
	<range><lt>28.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-117685: The OCI registry's cross-repository blob mount
	  checked the target package against the token's `public-only`
	  restriction, but checked the source blob only against the full
	  account permissions of the token owner. A `public-only` token with
	  `write:package` scope, whose owner can read a private package and
	  write to a public package namespace, could mount a blob of the
	  private package into the public package. The private blob, such as
	  a container layer, could then be downloaded by anyone through the
	  public package.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-117685</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-117685</url>
    </references>
    <dates>
      <discovery>2026-11-01</discovery>
      <entry>2026-11-02</entry>
    </dates>
  </vuln>