CVE-2026-20800
Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Summary
Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Original description
The description as published by the source.
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
gitea
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.4"}]}]
References
- advisory blog.gitea.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com