93 matches found
CVE-2026-59766
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...
SUSE CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
GO-2026-6071 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via /api/v1/user/starred and private issue titles via /api/v1/user/times in gitea.dev...
GO-2026-6041 Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea
Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea...
EUVD-2026-41603
Gitea: Notification API leaks private issue metadata after access revocation...
GHSA-44QC-PGVP-WX7V Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...
GHSA-QF2F-QH6P-7V89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getStarredRepos and ListMyTrackedTimes functions. An attacker can access private repository metadata and private issue titles after their access has been revoked by sending requests to the affected API...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...
CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
CVE-2026-58419 Notification API leaks private issue metadata after access revocation
Notification API leaks private issue metadata after access revocation...
CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
CVE-2026-58419 Notification API leaks private issue metadata after access revocation
Notification API leaks private issue metadata after access revocation...
CVE-2026-58419
The Gitea Notification API contains an information disclosure vulnerability where private issue or pull request metadata is leaked to users after their repository access has been revoked. While the repository field is correctly nulled out, the subject field remains accessible, exposing private ti...
