Is CVE-2026-71301 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-71301?

CVE-2026-71301 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-71301

Description

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite lacking Issues and Pull Requests access. This exposes pull request metadata across repository unit permissions.