CVE-2026-0798 Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags,...

CVE-2026-0798

The Gitea platform is vulnerable to an Incorrect Authorization flaw where users with revoked access can continue to receive release notification emails for private repositories. This occurs specifically when a repository's visibility is changed from public to private ; users who previously watche...