CVE-2026-20800
Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Résumé
Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
gitea
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.4"}]}]
Références
- advisory blog.gitea.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com