All vulnerabilities
CVE-2026-59766GHSA-qf2f-qh6p-7v89GO-2026-6071

Gitea private repository metadata disclosure after access revocation

Gitea GiteaGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.0Fixed versionGitHub
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 1.27.0code.gitea.io/gitea, goGitHubgo get code.gitea.io/gitea@v1.27.0
  • 1.27.0code.gitea.io/gitea, GoOSVgo get code.gitea.io/gitea@v1.27.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

Text from CVE List

Affected versions 3

  • Giteaaffected: 1.25.4CVE List
  • code.gitea.io/gitea, go1.25.4GitHub
  • code.gitea.io/gitea, Gofrom first release, fixed in 1.27.0OSV

References 2