CVE-2026-73135

Executive Summary

CVE-2026-73135 is an information disclosure vulnerability in Gitea arising from inconsistent repository visibility predicates. Certain repository-listing endpoints return repositories owned by accounts that are otherwise hidden from the requesting viewer, even though direct access to those repositories correctly returns HTTP 404. The flaw allows an unauthenticated, remote attacker to enumerate and confirm the existence of repositories and their associated metadata across an intended owner-visibility boundary, earning a CVSS v3.1 base score of 5.3 (Medium). No public proof-of-concept, exploit code, or Nuclei template is currently available, and no patch has been identified by tracked sources.

Technical Analysis

The vulnerability class is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The NVD description identifies the root cause as inconsistent repository visibility predicates: the authorization logic that governs repository visibility is not uniformly applied across all code paths. Specifically, the condition evaluated by some repository-listing endpoints admits repositories whose owners are hidden from the viewer, while direct routes to those same repositories correctly deny access with a 404 response.

Three technical properties follow directly from the description:

1. Predicate inconsistency. Two distinct access-control decisions exist for the same underlying object — one used by listing endpoints, one used by direct routes. They disagree for repositories belonging to hidden owners. This is a classic "second code path" access-control defect, where the negative (deny) case is implemented in one place and the enumeration/list query is implemented in another without the owner-visibility constraint.

2. 404-vs-listing oracle. Because direct routes return 404 (deliberately indistinguishable from "not found" or "forbidden"), the intended behavior is to hide the repository's existence entirely. The listing endpoint breaks this by returning the repository record, effectively converting a non-enumerable namespace into an enumerable one. The 404 behavior confirms the system intends to hide these objects — the listing is therefore unambiguously a boundary violation, not a design choice.

3. Disclosed data. The description states the issue "exposes repository existence and listing information." This is metadata-level disclosure — repository presence, and whatever fields the listing representation carries (names, ownership association, timestamps, visibility flags, description text). No code-level artifact names, route paths, or parameter names are provided in the source data, so no specific handler, query builder, or predicate function can be named here without fabrication.

Attack surface. Network-reachable repository listing endpoints of a Gitea instance. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the attack is remotely triggerable, requires low complexity, needs no authentication and no user interaction, and does not depend on victim participation. The scope is unchanged (S:U) — the vulnerable component's own security authority is what is bypassed. Confidentiality impact is Low (C:L), consistent with metadata rather than content disclosure; integrity and availability are Not Impacted.

Precondition. A target instance must host repositories whose owners are hidden from the requesting viewer. This is most likely relevant on instances with private/restricted owner accounts, organizational visibility restrictions, or account states that suppress owner disclosure. Instances with fully public ownership would not exhibit a meaningful boundary crossing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and does not assume any specific route, parameter, or function name.

1. Reconnaissance / target identification. The attacker identifies a reachable Gitea instance (e.g., via internet-wide scanning using the Shodan dorks above, or opportunistic discovery). No credentials are required at any stage, so the attacker can probe anonymously.

2. Triggering the flaw class. The attacker requests repository-listing endpoints on the target instance — the generic listing surfaces that enumerate repositories. Because the visibility predicate applied by the listing code path omits the owner-visibility constraint, the response includes repositories whose owners are hidden from the anonymous viewer. The attacker does not need to know the repository names in advance; the listing itself performs the enumeration.

3. Payload / execution method. There is no injected payload. The "exploit" is a single unauthenticated HTTP GET against the listing surface. The access-control violation is in the server's own query/response construction, not in attacker-supplied input. This is why the vector is PR:N/UI:N and AC:L — exploitation is a plain request, repeatable and automatable at scale.

4. Confirmation and differential validation. To distinguish genuine disclosure from expected behavior, the attacker compares the listing result against the direct route for the same repository. The direct route returns 404 (correct denial), while the listing returns the record — a clean differential proving the boundary crossing. This same differential also lets the attacker confidently distinguish "hidden because non-existent" from "hidden because owner-suppressed."

5. Post-exploitation impact. The attacker harvests repository existence and listing metadata: an inventory of repositories belonging to hidden owners, plus associated listing fields. This informs follow-on targeting — identifying private project names, organizational structure, ownership relationships, and candidate repositories for credential-stuffing, supply-chain reconnaissance, or further access attempts. No code execution, data modification, or availability impact occurs; the outcome is intelligence gain.

Impact Assessment

Confidentiality — Low (C:L). Consistent with the CVSS subscores, the disclosure is bounded to repository existence and listing metadata. Because only metadata is exposed and the direct-route protection remains intact, this is not a source-code leak. However, metadata alone is materially valuable: it names private repositories, reveals hidden owner/org structure, and maps the instance's true repository footprint.

Integrity — None (I:N). Availability — None (A:N). The flaw is read-only. Nothing is modified, deleted, or made unavailable.

Exploitability — High ease, Low privilege. AV:N/AC:L/PR:N/UI:N means any network-adjacent or internet-exposed instance is reachable by an unauthenticated attacker with no user interaction and no special conditions. Exploitation cost is effectively zero and fully automatable, which raises the practical risk above what the 5.3 base score alone suggests for high-value targets.

Blast radius. Every repository whose owner is hidden from a given viewer is enumerable. The recursion is important: the more an organization relies on hidden owners to conceal projects, the larger the leak. Organizations using Gitea as the system of record for private, sensitive, or embargoed projects are the primary exposure group.

Business impact. Direct monetary loss is unlikely; the impact is loss of control over the information boundary the organization believed it had. Consequences include premature disclosure of unannounced projects or products, organizational-structure reconnaissance usable for targeted social engineering and phishing against hidden account owners, supply-chain mapping of internal dependencies, and — because it is trivially automatable — bulk enumeration across many instances. Compliance exposure exists where repository existence and ownership data constitute protected information under internal data-classification or contractual confidentiality obligations.

Detection Guidance

Sigma Rule

title: Gitea Repository Listing Visibility Boundary Violation (CVE-2026-73135)
id: 8f3c1a52-7d4e-4b91-9a2e-cve202673135
status: experimental
description: Detects unauthenticated or low-privilege access to Gitea repository listing endpoints that return repository metadata for repositories whose direct routes would return HTTP 404 (hidden-owner boundary crossing).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73135
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: gitea
detection:
  selection_method:
    cs-method: 'GET'
  selection_listing:
    cs-uri-stem|contains:
      - '/explore/repos'
      - '/api/v1/repos/search'
  selection_anon:
    sc-status: 200
  condition: selection_method and selection_listing and selection_anon
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
  - cs-user-agent
falsepositives:
  - Legitimate anonymous browsing of public repositories
  - Search-engine crawlers indexing public content
level: low
tags:
  - attack.t1213
  - cve.2026.73135

YARA Rule

rule CVE_2026_73135_Gitea_Listing_Disclosure
{
    meta:
        description = "Detects Gitea web/application artifacts referencing repository visibility predicates inconsistent with owner-visibility checks (CVE-2026-73135)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73135"
        cve = "CVE-2026-73135"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $gitea = "Gitea" ascii wide nocase
        $explore = "/explore/repos" ascii wide
        $apisearch = "/api/v1/repos/search" ascii wide
        $vis1 = "IsRepositoryVisible" ascii wide
        $vis2 = "isRepositoryVisibleToUser" ascii wide
        $listing = "ListRepositories" ascii wide
        $buf = "bufio" ascii wide

    condition:
        $gitea and
        (
            (any of ($vis1, $vis2)) and
            (any of ($explore, $apisearch, $listing))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73135 Gitea Repository Listing Visibility Boundary Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/repos/search"; http.uri; content:"/explore/repos"; classtype:attempted-recon; reference:cve,2026-73135; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73135; metadata:affected_product Gitea, attack_target Web_Server, deployment Perimeter, signature_severity Minor; sid:202673135; rev:1;)

alert http any any -> any any (msg:"CVE-2026-73135 Gitea Unauthenticated Repository Enumeration Response"; flow:established,from_server; http.stat_code; content:"200"; http.content_type; content:"application/json"; file_data; content:"\"full_name\""; content:"\"owner\""; classtype:attempted-recon; reference:cve,2026-73135; sid:202673136; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "GET"
      and (url.path : "/api/v1/repos/search" or url.path : "/explore/repos") ]
  [ network where network.protocol == "http" and http.response.status_code == 200
      and http.response.mime_type : "application/json" ]

Splunk SPL Query

index=web sourcetype=gitea_access OR sourcetype=nginx OR sourcetype=apache
(http_uri_path="/api/v1/repos/search" OR http_uri_path="/explore/repos" OR uri_path="/explore/repos")
status=200
| eval anon = if(isnull(remote_user) OR remote_user="-" OR remote_user="", 1, 0)
| stats count dc(src_ip) AS unique_ips values(http_uri_path) AS paths BY src_ip, anon
| where count > 10
| sort - count
| table src_ip, anon, count, unique_ips, paths

Wazuh OSSEC Rule

<group name="web,gitea,cve-2026-73135,">
  <rule id="202673135" level="6">
    <if_sid>31100</if_sid>
    <field name="url">/api/v1/repos/search|/explore/repos</field>
    <field name="id">200</field>
    <description>CVE-2026-73135: Gitea repository listing endpoint accessed, possible hidden-owner visibility boundary disclosure</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>access_control,reconnaissance,</group>
  </rule>

  <rule id="202673136" level="10" frequency="15" timeframe="120">
    <if_matched_sid>202673135</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-73135: Repeated Gitea repository listing enumeration from same source (likely automated disclosure harvesting)</description>
    <group>access_control,reconnaissance,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (no upstream fix available):

• Restrict network exposure of the Gitea instance. Place it behind a VPN, identity-aware proxy, or IP allowlist so that only trusted network positions can reach repository listing endpoints. This directly removes the AV:N precondition for external actors.
• Enforce authentication at the reverse proxy for all listing and search endpoints. If anonymous browsing is not a business requirement, require authentication globally; this eliminates the unauthenticated (PR:N) exploitation path.
• Rate-limit and monitor the repository listing surfaces identified in the Detection Guidance section. Bulk enumeration is the observable signature of exploitation.
• Review the instance for repositories whose owners are intended to be hidden, and treat disclosure of those repository names as a potential information-loss event requiring notification per internal data-classification policy.
• Apply restrictive visibility defaults for new organizations/owners; minimize the number of hidden-owner-but-listed repositories, since these are precisely the objects at issue.

2) Patch / upgrade steps:

• No vendor fix is currently identified by any tracked source. Monitor the Gitea project's release notes, security advisories, and the NVD entry for CVE-2026-73135 for an official patched version.
• Because no affected version range has been published, inventory all deployed Gitea versions now so that patching can be applied immediately once a fixed release and its version boundary are announced.
• Do not apply unofficial or unverified patches to a production instance; wait for an upstream-signed release and validate it against the advisory.

3) Long-term hardening:

• Centralize authorization logic. The root cause is inconsistent predicates across code paths; the durable fix is a single, exhaustively applied visibility predicate rather than parallel implementations. Track this as a code-review priority if you maintain a fork.
• Adopt deny-by-default for listing, search, and enumeration endpoints that can reveal object existence.
• Add regression tests that assert listing endpoints never return objects whose direct routes return 404 — the exact differential identified in this CVE.
• Maintain an SBOM and asset inventory for self-hosted developer platforms so future advisories can be matched to deployed versions without delay.
• Treat repository existence and ownership as sensitive metadata in your data-classification scheme, and include metadata-disclosure scenarios in threat models for developer platforms.

References

• NVD — CVE-2026-73135: https://nvd.nist.gov/vuln/detail/CVE-2026-73135
• MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• Gitea project security advisories and release notes: https://github.com/go-gitea/gitea/security/advisories
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Additional notes on exploit availability and in-the-wild activity: No public proof-of-concept, exploit code, or Nuclei template is currently available for CVE-2026-73135, and the vulnerability is not listed in the CISA KEV catalog. No threat actor campaigns or evidence of exploitation in the wild have been reported by any tracked source. EPSS has not yet been scored by FIRST.org. The above references are provided for monitoring; as of reporting, the exploitation probability for this CVE cannot be quantified from first-party exploit or campaign data.