CVE-2026-107618
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued b
CVSS
—
Sin CVSS
EPSS
0.2%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 18 oct 2026 · Última mod.: 19 oct 2026
Sin historial EPSS suficiente todavía.
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
- blog.gitea.comhttps://blog.gitea.com/release-of-28.2.0/
- github.comhttps://github.com/go-gitea/gitea/pull/39839
- github.comhttps://github.com/go-gitea/gitea/pull/39847
- github.comhttps://github.com/go-gitea/gitea/releases/tag/v28.2.0
- github.comhttps://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w
Sin CVEs relacionados por CWE o producto.