CVE-2026-20800

Medium CVSS: 6.5

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

Vendor

Gitea

Product

Gitea

CWE

CWE-200

Yayın Tarihi

2026-01-22 22:16:17

Güncelleme

2026-01-29 21:57:04

Source Identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

KEV Date Added

Kategoriler

CWE-200 Gitea MEDIUM Gitea 2026

Referanslar

https://blog.gitea.com/release-of-1.25.4/ https://github.com/go-gitea/gitea/pull/36339 https://github.com/go-gitea/gitea/releases/tag/v1.25.4 https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q

Benzer Kayıtlar

Medium

CVE-2026-20904

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to cha…

Critical

CVE-2026-20912

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a…

Critical

CVE-2026-20897

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repos…

High

CVE-2026-20736

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachmen…

Critical

CVE-2026-20750

Gitea does not properly validate project ownership in organization project operations. A user with project write access…

Medium

CVE-2026-20883

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository…