CVE-2026-109844: Gitea watched repositories API disclosure after access revocation
GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 1.27.0 - Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 28.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must have watched a private repository while they had access to it, then later lose access, such as after a team permission downgrade. That user could still retrieve the repository's metadata through the subscriptions API.
What information could remain exposed after access is revoked?
The affected API response could disclose the private repository's name, description, clone URLs, owner, and counters. The described issue concerns metadata returned by GET /api/v1/user/subscriptions.
Which versions address the issue?
The issue was fixed in Gitea 1.27.0 and 28.0.0. It was disclosed with version 28.2.0.