Gitea EUVD-2026-101280

Exploitation requires three concurrent conditions: (1) the attacker must have previously held collaborator access to the target Gitea instance and must have starred at least one private repository or logged time on at least one issue in a private repository; (2) the attacker must possess a Gitea API token or session credential that was issued before revocation and has not been explicitly invalidated - Gitea's repository-permission revocation does not automatically expire tokens; (3) the target instance must run a version of Gitea prior to 1.27.0. The exposure is strictly metadata: repository full_name, private flag, clone_url, and ssh_url from the starred endpoint; issue title and state from the time-tracking endpoint. Repository source code, commit history, file contents, and comment bodies are not exposed. Scope is further limited to only those private repositories the revoked user personally starred or tracked time on - general enumeration of all instance-private repos is not possible via these endpoints.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3 Medium) accurately captures the risk profile: network-reachable with low complexity, but gated behind a previously-issued authenticated token (PR:L), with only limited confidentiality impact. Real-world risk is meaningful for organizations with strict information compartmentalization - contractors or former employees who starred sensitive repositories or logged time on confidential issues retain indefinite metadata visibility after revocation. The exposure is bounded: only repositories the revoked user personally starred or tracked time on are affected, not arbitrary private repositories on the instance. No EPSS score was supplied in the input and cannot be independently inferred. No KEV listing exists; active exploitation in the wild is not confirmed. The 'Authentication Bypass' tag in the advisory is somewhat imprecise - this is a post-revocation authorization failure (CWE-863), not a bypass of authentication itself. The incomplete-patch lineage from CVE-2026-20800 increases urgency for instances that believed they were already remediated.

A former contractor whose collaboration access to a Gitea organization is revoked still possesses a valid personal API token issued before revocation. They issue GET /api/v1/user/starred with that token and receive full JSON objects - including private: true, clone_url, and ssh_url - for private repositories they previously starred, despite a 404 being returned when they attempt direct repo access. They follow up with GET /api/v1/user/times and retrieve private issue titles such as 'SECRET: Q3 acquisition target' along with issue states, obtaining sensitive project intelligence with no public proof-of-concept code required beyond the reproduction steps documented in the GHSA advisory.