Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

CVE-2026-20800

creationtimestamp| type| source ---|---|--- 2026-01-22 23:21:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md2davrgmg26 2026-01-24 21:22:09+00:00| seen| https://gist.github.com/alon710/12a87bde6b1571c741d36ec36f95b2c8...