{"id":"CVE-2026-107618","kind":"vulnerability","aliases":["CVE-2026-107618"],"related":[],"title":"Gitea-style forge: cross-site request changes repository topics without protection","description":"`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.","summary":"The route that sets repository topics on POST /{owner}/{repo}/topics was registered without the sign-in middleware that blocks cross-origin requests. A repository administrator who opens a malicious page can have that repository's topics changed, and no other repository settings are reachable through this route.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","web-app"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:44+00:00","updated_at":"2026-10-25T05:12:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:12:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Gitea-style forge: cross-site request changes repository topics without protection","impact":"low","summary":"The route that sets repository topics on POST /{owner}/{repo}/topics was registered without the sign-in middleware that blocks cross-origin requests. A repository administrator who opens a malicious page can have that repository's topics changed, and no other repository settings are reachable through this route.","category":"other","nicknames":[],"who_cares":["self-hosted","web-app"],"confidence":0.5,"needs_auth":"yes","worst_case":"Repository topics changed by a cross-site request from an admin's browser","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107618, then confirm the fixed release and the exact route handler.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000518,"input_tokens":3309,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107618':16A,19A '-2026':15A,18A '/topics':37B,80C 'administr':54B,111C 'app':26B 'block':47B 'chang':9A,66B,124C 'could':117C 'cross':6A,49B,93C 'cross-origin':48B,92C 'cross-sit':5A 'cve':14A,17A 'forg':4A 'gitea':2A 'gitea-styl':1A 'host':23B 'issu':99C 'malici':58B,115C 'middlewar':45B,88C 'open':56B 'origin':50B,94C 'owner':35B,78C 'page':59B,116C 'parti':104C 'post':34B,77C 'protect':13A,95C 'provid':90C 'reachabl':73B,130C 'regist':39B,82C 'reject':108C 'repo':36B,79C 'repositori':10A,31B,53B,63B,70B,110C,123C,127C 'request':8A,51B,98C 'rout':28B,76B,133C 'self':22B 'self-host':21B 'set':30B,71B,128C 'sign':43B,86C 'sign-in':42B,85C 'site':7A,105C 'style':3A 'third':103C 'third-parti':102C 'topic':11A,32B,65B,120C 'visit':113C 'web':25B 'web-app':24B 'without':12A,40B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107618","severity":null,"published_at":"2026-10-18T19:16:32+00:00","modified_at":"2026-10-19T20:52:16+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}