CVE-2026-20800
published 2026-01-22CVE-2026-20800: Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.37%
30.3th percentile
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| code.gitea.io | gitea | >= 0 < 1.25.4 | 1.25.4 |
| code.gitea.io | gitea | >= 0 < 1.26.4 | 1.26.4 |
| gitea | gitea | < 1.25.4 | 1.25.4 |
| gitea | gitea_open_source_git_server | <= 1.25.3 | — |
| github.com | go-gitea_gitea | >= 0 < 1.25.4 | 1.25.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ghsa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
ghsa·2026-07-21·CVSS 6.5
CVE-2026-59766 [MEDIUM] CWE-863 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
## Summary
CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two
sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo
access at output time:
- `GET /api/v1/user/starred` — `getStarredRepos()` computes a per-repo permission but still lists every
starred repo (no filtering), so the full repo object (`full_name`, `private`, `clone_url`, `ssh_url`)
of a now-inaccessible private repo is returned.
- `GET /api/v1/user/times` — `ListMyTrackedTimes()` queries by `UserID` only and `LoadAttributes` brings
in the issue (`title`, `state`)
GHSA
Gitea: Notification API leaks private issue metadata after access revocation
ghsa·2026-07-21·CVSS 6.5
CVE-2026-58419 [MEDIUM] CWE-200 Gitea: Notification API leaks private issue metadata after access revocation
Gitea: Notification API leaks private issue metadata after access revocation
# Summary
An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject` field remains accessible and continues to expose private metadata.
# Details
CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked.
During testing on Gitea v1.26.2, the `repository` field in `NotificationThread` responses is correctly set to `null` after access revocation. However, the
OSV
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
osv·2026-02-02
CVE-2026-20800 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
OSV
Gitea improperly exposes issue and pull request titles
osv·2026-01-23
CVE-2026-20800 [LOW] Gitea improperly exposes issue and pull request titles
Gitea improperly exposes issue and pull request titles
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
GHSA
Gitea improperly exposes issue and pull request titles
ghsa·2026-01-23
CVE-2026-20800 [LOW] CWE-200 Gitea improperly exposes issue and pull request titles
Gitea improperly exposes issue and pull request titles
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
No detection rules found.
No public exploits indexed.
2026-01-22
Published