Gitea EUVD-2026-41603

Exploitation requires an authenticated Gitea account that previously had access to the target private repository/issues and generated notification records before that access was revoked; the attacker then reads the Notification API to retrieve retained private-issue metadata. Limiting factors: the actor must be a former (or currently reduced-privilege) authorized user, not an anonymous internet attacker despite the CVSS PR:N metric - a fully deleted account does not retain the notifications, and the leak is confined to issue metadata rather than full issue bodies or repository contents. Affected deployments are Gitea 1.26.x up to 1.26.2 exposing the Notification API.

Signals are largely consistent but point to a moderate, not critical, real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) rates it high with a confidentiality-only impact, but the PR:N metric conflicts with the described scenario: the vulnerability specifically concerns a user AFTER access revocation, which implies the attacker must be (or have been) an authenticated Gitea account with prior access - so realistic exploitation requires at least low privileges (PR:L), which the raw score does not reflect. EPSS is low (0.17%, 7th percentile) and there is no KEV listing and no known POC, so this is not under active or automated exploitation. SSVC framing would be roughly: exploitation=none observed, automatable=no (requires a specific prior-access relationship per target), technical impact=partial (metadata leak, no integrity/availability effect). Net: a legitimate data-exposure bug worth patching on a normal cycle, but the CVSS 7.5 likely overstates urgency because the C:H and PR:N metrics are generous for what is a metadata-only leak requiring a former authorized user.

A contractor is granted access to a private Gitea repository, subscribes to (or is notified about) sensitive private issues, and later has their repository access revoked at the end of the engagement. Because their account still exists, they query the Notification API and continue to receive metadata about the private issues they were previously involved in, learning issue titles and activity they should no longer see. No public exploit code exists, and the low attack complexity (AC:L) means the only real prerequisite is having held prior access.