CVE-2026-107618: Gitea cross-site request forgery on repository topics

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-29
Weakness: CWE-352

Description

`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

Affected products

Gitea Open Source Git Server: through 28.1.0

References

https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39839
https://github.com/go-gitea/gitea/pull/39847
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w

Get alerted when CVE-2026-107618 or the next vulnerability affects your stack