CVE-2026-59766

MEDIUM 4.3

Gitea private repository metadata disclosure after access revocation

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

Vendor	gitea
Product	gitea
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new medium vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

1.25.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89 github.com: https://github.com/go-gitea/gitea/pull/38324

Credits

🔍 https://github.com/sec-reex