PUBLISHED
2026-10-14 15:17
MODIFIED
2026-10-14 15:17
EPSS (Prob. Exploit)
0.28%
Top 80.8%
> DESCRIPTION
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
Cette CVE est récente (3 days ago) - les informations détaillées peuvent prendre quelques jours.
> GITHUB SECURITY ADVISORY
GHSA-qf2f-qh6p-7v89
MODERATE
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
AFFECTED PACKAGES:
GO / code.gitea.io/gitea
< 1.27.0
Fixed in: 1.27.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Gitea private repository metadata disclosure after access revocation
AFFECTED PACKAGES:
Unknown / Unknown
2 versions affected
ALIASES:
GHSA-qf2f-qh6p-7v89, GO-2026-6071
> HISTORIQUE DES MODIFICATIONS
Première apparition
14/10/2026 15:17
Source: NVD
Total des modifications: 0
Dernière mise à jour: 3 days ago