Quick answers
- Is CVE-2026-117649 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-117649 being exploited in the wild.
- How severe is CVE-2026-117649?
- Informational severity, published 1 November 2026.
- Which products and versions are affected?
- Gitea before 28.3.0.
- Is there a fix for CVE-2026-117649?
- Yes: fixed in Gitea 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-117649 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-117649?
- Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Gitea 28.3.0
Technical details
The issue timeline API and web UI failed to apply read permission checks to "dependency added" and "dependency removed" events, unlike other cross-reference events. When a readable issue had been linked as a dependency to an inaccessible issue (e.g., in a private repository), any reader including anonymous users could extract the private issue's metadata through the API or web interface. The vulnerability affected dependency event filtering and required write access to both issues to create the link; comments and attachments remained protected.
Affected products
- Gitea Gitea before 28.3.0
Timeline
- 2026-11-01: disclosed