@ChALkeR reported that titles of private issues and pull requests could be disclosed by editing comments made by other users. If a user posted a comment to a repository, an administrative user of that repository could edit their comment and disclose titles using the permissions of the original commenting user. We fixed this issue by changing how tooltips for cross-reference links are resolved and cached.