{"schema":"threatline.record/2","record":{"id":"CVE-2026-59766","aliases":["GHSA-qf2f-qh6p-7v89","GO-2026-6071"],"summary":"Gitea private repository metadata disclosure after access revocation","details":"Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.","categories":["Libraries & packages"],"product":"Gitea","vendor":"Gitea","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59766","source_modified_at":"2026-10-14T15:31:06.825Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Gitea","vendor":"Gitea","versions":[{"status":"affected","version":"1.25.4"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","source_modified_at":"2026-07-18T20:02:59Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"go","name":"code.gitea.io/gitea"},"range":"1.25.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qf2f-qh6p-7v89","source_modified_at":"2026-07-27T17:11:25.889803545Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"Go","name":"code.gitea.io/gitea","purl":"pkg:golang/code.gitea.io/gitea"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.27.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","source_modified_at":"2026-07-18T20:02:59Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"go","name":"code.gitea.io/gitea"},"version":"1.27.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qf2f-qh6p-7v89","source_modified_at":"2026-07-27T17:11:25.889803545Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"Go","name":"code.gitea.io/gitea","purl":"pkg:golang/code.gitea.io/gitea"},"version":"1.27.0"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00281,"percentile":0.19556,"score_date":"2026-10-23"},"published_at":"2026-10-14T14:28:20.687Z","modified_at":"2026-10-14T15:31:06.825Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59766","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T15:31:06.825Z"},{"source":"GitHub Advisory Database","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-07-18T20:02:59Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-qf2f-qh6p-7v89","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-07-27T17:11:25.889803545Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59766","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/go-gitea/gitea/pull/38324","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T15:31:00.508506Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T15:31:06.825Z","content_hash":"44170cf09b49133daa2f1f4905801072717c584250fa28a768e4aa1bdb7e80f1"}}