Executive brief
Gitea is a self-hosted software development service similar to GitHub. A security issue was identified where users who previously had access to a private project could still see basic information about that project (like its name and description) even after their access was officially revoked. While this does not expose the actual source code or sensitive files, it allows unauthorized individuals to track the project's name and status changes.
Technical details
An information disclosure vulnerability exists in Gitea's API due to missing authorization checks in the 'starred' and 'subscriptions' endpoints. When a user's access to a private repository is revoked, they are correctly blocked from direct repository access; however, if they had previously 'starred' or 'subscribed' to the repository, the metadata remains visible via `GET /api/v1/user/starred` and `GET /api/v1/user/subscriptions`. An authenticated attacker can view the repository's full name, description, and visibility status, including updates made to these fields after revocation. The vulnerability is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial disclosure to vendor
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0