CVE-2026-107618

`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

EPSS

0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)

Published

2026-10-18

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

References

• https://blog.gitea.com/release-of-28.2.0/
• https://github.com/go-gitea/gitea/pull/39839
• https://github.com/go-gitea/gitea/pull/39847
• https://github.com/go-gitea/gitea/releases/tag/v28.2.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w

Check your stackJSON