Answer in brief
CVE-2026-123009 records a Unknown severity vulnerability in Gitea base repository code disclosure through the web editor in forks. The current sources do not mark it as known exploited. The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Gitea/Giteageneric | >=1.25.0 <28.4.0 | 28.4.0 |
Published upstream
Nov 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 15, 2026
When a file is edited in a fork through the web editor, Gitea can first copy a branch from the base repository into the fork. That copy did not check whether the user may read the base repository's code. A user who had forked a repository and later lost access to it, for example after it was made private or they were removed as a collaborator, could keep copying its current branches into their fork and read them. The copy now requires read access to the code of the base repository.
Quoted source text, attributed separately from HOL analysis.