Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 23 Jan 2026 08:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content. | |
| Title | Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation | |
| Weaknesses | CWE-284 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-01-22T22:01:49.410Z
Reserved: 2026-01-08T23:02:08.534Z
Link: CVE-2026-0798
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T22:16:15.957
Modified: 2026-01-22T22:16:15.957
Link: CVE-2026-0798
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses