Executive brief
Gitea, a popular self-hosted Git service, contains a flaw where changing a public repository to private via the API fails to remove existing 'watchers.' This means that users who were watching the repository while it was public can still see sensitive metadata—such as descriptions, branch names, and activity counts—even after they should have lost access. This primarily affects organizations using automated tools or scripts to manage repository privacy.
Technical details
A vulnerability exists in Gitea's repository update logic where the 'ClearRepoWatches' cleanup task is missing from the API-driven code path. While the web UI correctly triggers this cleanup in 'MakeRepoPrivate', the REST API path (PATCH /api/v1/repos/{owner}/{repo}) calls 'updateRepository', which only clears repository stars. Consequently, stale watch records persist for users who watched the repo while it was public. These users can then access full repository JSON metadata (description, default branch, license, etc.) via the '/api/v1/user/subscriptions' endpoint despite having no formal access to the private repository. The issue was introduced by an incomplete fix for a previous vulnerability (GHSA-8fwc-qjw5-rvgp) and is resolved in version 1.27.0.
Affected products
- Gitea Gitea >= 1.25.4, < 1.27.0
Timeline
- 2026-05-16: other: Vulnerability confirmed present in master branch HEAD
- 2026-07-13: advisory: Initial GitHub Advisory published
- 2026-07-21: disclosed: CVE-2026-58510 assigned and published
- 1.27.0: patched