CVE-2026-107618: Gitea cross-site request forgery on repository topics
POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Affected Software
Event History
Frequently Asked Questions
Who could be affected by an exploit?
A repository administrator would need to visit a malicious third-party page. The impact is limited to repositories for which that user has administrator privileges.
What could an attacker change through this issue?
An attacker could cause the repository's topics to be changed through the affected POST route. No other repository settings were reachable through that route.
What interaction is required for exploitation?
The attack requires a repository administrator to visit a malicious page that issues a cross-site request to the topics endpoint.