GO-2026-6071

vendorUSosv

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev

view advisory published 2026-07-27Licence: per source

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-59766US	—OT elevated	0.28% (21st)	—	2026-10-14
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose acc…

references

External citations — patches, advisories, analysis.

https://github.com/go-gitea/gitea/releases/tag/v1.27.0WEB
https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan