CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

CVE-2026-59766

The Git repository management system Gitea is vulnerable to an access control deficiency in its starred-repository and tracked-time API endpoints. Specifically, the getStarredRepos() function in routers/api/v1/user/star.go and the ListMyTrackedTimes() function in routers/api/v1/repo/issue_tracked...

CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...