Vulnerability · Published Oct 18, 2026 · Assigned by Gitea

CVE-2026-109844Gitea watched repositories API disclosure after access revocation

Medium 4.3

In plain English

A medium-severity missing authorization in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.26.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-96gv-2xc4-4hxj vendor-advisory
Fix: go-gitea/gitea pull request #38321 patch
Fix backport to release/v1.27: go-gitea/gitea pull request #38390 patch
Gitea 28.2.0 release announcement release-notes
go-gitea/gitea v28.2.0 release release-notes