BIT-gitea-2026-20800

vendorUSosv

Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

view advisory published 2026-01-30Licence: per source

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-20800US	—	0.40% (33rd)	—	2026-01-22
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may…

references

External citations — patches, advisories, analysis.

https://blog.gitea.com/release-of-1.25.4/ARTICLE
https://github.com/go-gitea/gitea/pull/36339FIX
https://github.com/go-gitea/gitea/releases/tag/v1.25.4ARTICLE
https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7qWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-20800WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan