CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

CVE-2026-109844

The Gitea platform is vulnerable to an information disclosure flaw via the GET /api/v1/user/subscriptions endpoint. The application fails to verify if a user retains access to a watched repository after their permissions are revoked, such as through a team permission downgrade. Consequently, an u...