Gitea: Cross-site request forgery in repository topics
Summary
Gitea up to and including 28.1.0 does not apply cross-origin protection to the endpoint POST /{owner}/{repo}/topics. A third-party website can submit a request that changes the topics of a repository on behalf of a repository administrator who is signed in and visits the malicious page. According to the vendor, no other repository settings can be changed through this route.
Affected
- Gitea 0 to 28.1.0
Fixed in
- Gitea 28.2.0 (fixed by #39839 / #39847)
Workaround
- No vendor workaround documented.
Exploitation
- No known exploitation.
- CISA SSVC: Exploitation none, not automatable.
- Requires user interaction: a logged-in repository administrator must visit an attacker-controlled page.
Our recommendation
- Upgrade Gitea to 28.2.0 or later, together with the other security fixes in this release.
- Limit repository administrator rights to necessary users.
- Ask administrators not to browse untrusted websites while logged in to Gitea.
- Check the topics of important repositories for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 28.2.0 is released (vendor blog) blog.gitea.com
- Pull Request #39839: add missing checks to several handlers and models github.com
- Pull Request #39847 github.com
- Gitea v28.2.0 release github.com
- GHSA-4jmf-h2cm-hg7w security advisory github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:45.
Original description (NVD)
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.