CVE-2026-73135: Gitea hidden-owner repository listing disclosure
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.
Affected Software
Event History
Frequently Asked Questions
What information can be exposed through the affected listing endpoints?
The issue discloses repository metadata, including the existence of repositories owned by users or organizations hidden from the viewer. Direct routes to those repositories still deny access with a 404 response.
What access does an attacker need to exploit this?
The disclosure occurs when a viewer can access repository-listing endpoints whose visibility checks admit repositories with hidden owners. The provided information does not specify whether authentication is required or identify the affected endpoints.
How can I identify potential exposure?
Review repository-listing behavior for viewers who should not be able to see hidden owners, and compare it with direct repository-route access. A listing that reveals repository metadata while the direct route returns 404 indicates the described visibility-boundary failure.