Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...

GHSA-QF2F-QH6P-7V89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

PT-2026-63300

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A user who previously had access to a private repository can continue to obtain repository metadata after their access has been revoked. While direct access to the repository is correctly denie...

PT-2026-63316

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw allows users whose access has been revoked to continue accessing private information through specific endpoints. A former collaborator can enumerate private repositories they previously starred and read...