Executive brief
Gitea is a self-hosted service for managing software development projects. A security flaw in its notification system allows users who have had their access to a private project revoked to continue seeing sensitive information about that project. This includes the titles of private issues and pull requests, as well as updates on ongoing activity, which could lead to the exposure of confidential development plans or internal discussions.
Technical details
An information disclosure vulnerability exists in Gitea's Notification API due to inconsistent access control application. While the 'repository' field in the NotificationThread response is correctly nullified after a user's access is revoked, the 'subject' field remains populated with sensitive metadata. This metadata includes private issue/PR titles, state, and URLs. Furthermore, if new comments are added to the thread, the 'latest_comment_url' and 'updated_at' fields continue to update, allowing unauthorized users to monitor ongoing activity. The vulnerability affects the GET /api/v1/notifications and GET /api/v1/notifications/threads/{id} endpoints and is patched in version 1.26.4.
Affected products
- Gitea Gitea < 1.26.4
Timeline
- 2026-07-01: disclosed
- 2026-07-03: advisory: NVD publication
- 2026-07-21: patched: GitHub Advisory published/updated