{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123006", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-15T20:29:37.611Z", "datePublished": "2026-11-15T21:10:18.973Z", "dateUpdated": "2026-11-15T21:10:18.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-15T21:10:18.973Z"}, "title": "Gitea password hash disclosure through repository search", "descriptions": [{"lang": "en", "value": "The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner's full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "28.0.0", "status": "affected", "lessThan": "28.4.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-frjx-8pcw-8c9q", "name": "GitHub Security Advisory GHSA-frjx-8pcw-8c9q", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/40377", "name": "Fix: go-gitea/gitea pull request #40377", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40384", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40384", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.4.0/", "name": "Gitea 28.4.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0", "name": "go-gitea/gitea v28.4.0 release", "tags": ["release-notes"]}], "credits": [{"lang": "en", "value": "https://github.com/lichoin", "type": "reporter"}, {"lang": "en", "value": "https://github.com/Tfo0", "type": "reporter"}, {"lang": "en", "value": "https://github.com/bircni", "type": "remediation developer"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "28.4.0", "status": "affected", "version": "28.0.0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner's full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status."}], "id": "CVE-2026-123006", "lastModified": "2026-11-15T21:16:54.553", "metrics": {}, "published": "2026-11-15T21:16:53.803", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-28.4.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40377"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40384"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-frjx-8pcw-8c9q"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred"}

{}

{}