CVE-2026-73135

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary.

• CWE-200

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39009
• https://github.com/go-gitea/gitea/pull/39012
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72

Published

Oct 14, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7312CWE‑522: Insufficiently Protected Credentials in web service…7.5
• CVE-2026-73122A flaw was found in the multicloud-operators-channel compone…7.7
• CVE-2026-73125Ebyte device web management interface does not consistently …9.8
• CVE-2026-73126Gitea's Actions workflow status badge endpoint does not enfo…4.3
• CVE-2026-7313CWE‑522: Insufficiently Protected Credentials in web service…4.9
• CVE-2026-73130Gitea does not limit the length of the gitignores field acce…4.3
• CVE-2026-73136Authentication Bypass by Capture-replay in ZenHive mpp allow…7.5
• CVE-2026-73137A flaw was found in the multicloud-operators-subscription co…7.7
• CVE-2026-7314A vulnerability was detected in eiceblue spire-doc-mcp-serve…7.3
• CVE-2026-73140Affected versions of cti-transmute fail to apply comment-lev…5.3
• CVE-2026-7315A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1…7.3
• CVE-2026-73155Affected versions of cti-transmute allow authenticated users…5.3