Vulnerability advisory
CVE-2026-59766
Gitea private repository metadata disclosure after access revocation
Also known as GHSA-qf2f-qh6p-7v89GO-2026-6071
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/go-gitea/gitea ↗ | |
| 369830bada2fd8826a5135cb2fc66660a9bef708 through 369830bada2fd8826a5135cb2fc66660a9bef708 | No fix listed |
Also listed as affected (2)
| |
Description
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.