Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 23 Jan 2026 08:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications. | |
| Title | Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation | |
| Weaknesses | CWE-200 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-01-22T22:01:50.368Z
Reserved: 2026-01-08T23:02:37.571Z
Link: CVE-2026-20800
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T22:16:17.540
Modified: 2026-01-22T22:16:17.540
Link: CVE-2026-20800
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses