Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-59766Gitea private repository metadata disclosure after access revocation

Medium 4.3

In plain English

A medium-severity improper access control in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.gitea.io/gitea	1.27.0	GHSA-qf2f-qh6p-7v89
Go	gitea.dev	1.27.0	GO-2026-6071

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.25.4

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-qf2f-qh6p-7v89 vendor-advisory
Fix: go-gitea/gitea pull request #38324 patch