CVE-2026-71301: Gitea private pull request title disclosure through markup
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite lacking Issues and Pull Requests access. This exposes pull request metadata across repository unit permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A member of a private repository who has Wiki access can exploit it even if they do not have access to the repository's Issues or Pull Requests units.
What information can be disclosed?
The affected markup preview behavior can disclose the title of a private pull request and its state icon. The issue concerns pull request metadata exposed through same-repository pull request references.
Does exploitation require access to the target repository?
Yes. The described attacker is a member of the private repository with Wiki access; the provided information does not indicate that unauthenticated or external users can exploit it.
How is the disclosure triggered?
The user submits a markup preview request containing a same-repository pull request reference. The markup endpoint resolves that reference without checking Pull Requests permission.