The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner's full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 15 Nov 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner's full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status. | |
| Title | Gitea password hash disclosure through repository search | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-15T21:10:18.973Z
Reserved: 2026-11-15T20:29:37.611Z
Link: CVE-2026-123006
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-15T21:16:53.803
Modified: 2026-11-15T21:16:54.553
Link: CVE-2026-123006
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.