CVE-2026-20800: Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20800?
CVE-2026-20800 is classified as a medium severity vulnerability due to its limitation on user access control.
How do I fix CVE-2026-20800?
To fix CVE-2026-20800, update Gitea to version 1.25.4 or later.
What type of data can be leaked due to CVE-2026-20800?
CVE-2026-20800 can leak private repository issue titles and pull request details to previously granted collaborators after their access has been revoked.
Who is affected by CVE-2026-20800?
Users of Gitea who manage private repositories and have collaborators whose permissions have been revoked are affected by CVE-2026-20800.
What component of Gitea does CVE-2026-20800 impact?
CVE-2026-20800 impacts the Notification API of Gitea by failing to properly validate repository access permissions.