CVE-2026-119533

— UNSCOREDpublic exploit available

Published 2026-11-01 · Updated 2026-11-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/go-gitea/gitea/pull/40016
https://github.com/go-gitea/gitea/pull/40134
https://github.com/go-gitea/gitea/releases/tag/v28.3.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg

All references

https://blog.gitea.com/release-of-28.3.0/
https://github.com/go-gitea/gitea/pull/40016
https://github.com/go-gitea/gitea/pull/40134
https://github.com/go-gitea/gitea/releases/tag/v28.3.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-c45m-jm46-mwxg

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-11455
MEDIUMCVE-2025-12523PoC
MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
MEDIUMCVE-2025-7043
HIGHCVE-2025-71433PoC
MEDIUMCVE-2026-0198

Related by shared AI tags and CWE weakness class. Browse the full archive.