CVE-2026-107618
NONE—CVSS v3
—CVSS v2
0.16%
EPSS (exploit probability)
—CWE
Description
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Affected routers (0)
No routers currently mapped to this CVE in our database.