Detections
Analytics
CVE-2026-107618
high
Description
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
References
https://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/pull/39847
https://github.com/go-gitea/gitea/pull/39839