Live › vulnerability › CVE-2026-107618
Go to dashboardThe route that sets repository topics on POST /{owner}/{repo}/topics was registered without the sign-in middleware that blocks cross-origin requests. A repository administrator who opens a malicious page can have that repository's topics changed, and no other repository settings are reachable through this route.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
This page as .md · .json · in your agent: get_signal("CVE-2026-107618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.