EUVD-2026-41603
GHSA-44qc-pgvp-wx7v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The abuse requires a former authorized account so PR:L not PR:N, and only issue metadata leaks (not full contents), so C:L with no integrity or availability impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Notification API leaks private issue metadata after access revocation
AnalysisAI
Information disclosure in Gitea Open Source Git Server (through 1.26.2) allows a user whose repository access has been revoked to continue viewing private issue metadata via the Notification API, because notification records are not purged or re-authorized when permissions change. The CVSS 3.1 base score is 7.5 (C:H) and the vendor (Gitea) fixed it in 1.26.3/1.26.4. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood.
Technical ContextAI
Gitea is a self-hosted, lightweight Git service written in Go that provides issue tracking, pull requests, and a REST/Notification API. The flaw is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) issue in the notification subsystem: when a user is unsubscribed from a repository or has their access revoked, previously generated notification entries tied to private issues are not invalidated or re-checked against current permissions. As a result, the Notification API endpoint continues to return metadata (such as issue titles, identifiers, and repository/issue linkage) for issues the user should no longer be able to see. The root cause is a missing authorization re-check at the notification read path rather than at the subscription creation path. The upstream fix is in go-gitea/gitea PR #38108, shipped in release v1.26.4.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.26.4 (or 1.26.3), which contains the fix from PR https://github.com/go-gitea/gitea/pull/38108; see the release notes at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ and the advisory at https://github.com/go-gitea/gitea/security/advisories/GHSA-44qc-pgvp-wx7v. Upgrading is the primary and recommended action since it is a self-contained binary/container swap. If an immediate upgrade is not possible, compensating controls are limited because the leak is in the API authorization logic itself: promptly and fully remove offboarded users' accounts rather than only revoking repository access (deleting the account clears their notification stream), and where feasible restrict Notification API exposure by placing the instance behind an authenticated reverse proxy or network ACLs to reduce which accounts can reach the endpoint. Note the trade-off that deleting accounts is disruptive to legitimate multi-repo users and network restrictions do nothing against an already-authenticated former collaborator, so these are stopgaps only - patching is the real fix.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account w
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository li
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today