Vulnerability advisory
BIT-gitea-2026-0798
Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation
Also known as CVE-2026-0798GHSA-8fwc-qjw5-rvgpGHSA-f4wq-6ww5-m56pGO-2026-4365
Severity
Severity not reported.
Affected versions
gitea Bitnami
| Affected | Fixed in |
|---|---|
| All versions before 1.25.4 | 1.25.4 |
Severity for this package
| |
Description
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.