CVE-2026-71301

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The repository markup endpoint resolves pull request references within the same repository without verifying if the user has the required Pull Requests permission. This allows a user with limited access, such as Wiki-only permissions in a private repository, to submit a markup preview request and obtain the title and state icon of a private pull request. This issue results in the exposure of pull request metadata across different repository unit permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.