`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitea |
|
No data.
No data.
References
History
Tue, 20 Oct 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gitea
Gitea gitea |
|
| Vendors & Products |
Gitea
Gitea gitea |
Tue, 20 Oct 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 19 Oct 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Sun, 18 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0. | |
| Title | Gitea watched repositories API disclosure after access revocation | |
| Weaknesses | CWE-862 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Gitea
Published: 2026-10-18T18:57:08.476Z
Updated: 2026-10-19T20:16:31.969Z
Reserved: 2026-10-14T20:08:45.827Z
Link: CVE-2026-109844
Vulnrichment
Updated: 2026-10-19T20:16:22.952Z
NVD
Status : Awaiting Analysis
Published: 2026-10-18T19:16:33.090
Modified: 2026-10-19T21:17:05.513
Link: CVE-2026-109844
Redhat
No data.