GO-2026-6041 Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea

Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

CVE-2026-58419

The Gitea Notification API contains an information disclosure vulnerability where private issue or pull request metadata is leaked to users after their repository access has been revoked. While the repository field is correctly nulled out, the subject field remains accessible, exposing private ti...

CVE-2026-34970

Summary: CVE-2026-34970 affects MantisBT, where versions 2.28.1 and earlier allow a bugnote author to view the Revisions page of a private issue after losing access to that issue. This undermines confidentiality by exposing private issue metadata on the Revisions page. Root cause (as described): ...

MantisBT Information Disclosure Vulnerability (CNVD-2021-00827)

MantisBT is a lightweight, free and open source, web-based defect tracking system. An information disclosure vulnerability exists in MantisBT versions prior to 2.24.4. The vulnerability stems from a failure to check access to bugrevisionviewpage.php correctly. An attacker can exploit the...