CVE-2026-107618
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued b
CVSS
—
No CVSS
EPSS
0.2%
p4
KEV
—
Exploit Today
1
0-100
Published: Oct 18, 2026 · Last modified: Oct 19, 2026
Not enough EPSS history yet.
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
- blog.gitea.comhttps://blog.gitea.com/release-of-28.2.0/
- github.comhttps://github.com/go-gitea/gitea/pull/39839
- github.comhttps://github.com/go-gitea/gitea/pull/39847
- github.comhttps://github.com/go-gitea/gitea/releases/tag/v28.2.0
- github.comhttps://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w
No related CVEs by CWE or product.