Executive brief
Gitea, a popular self-hosted Git service, contains a vulnerability where users who have had their access revoked can still view certain metadata about private projects. Specifically, a former collaborator can still see the names and URLs of private repositories they previously 'starred' and the titles of private issues they previously logged time on. While this does not allow access to the actual source code or file contents, it results in the unauthorized disclosure of project names and internal issue descriptions.
Technical details
An authorization bypass exists in Gitea's API due to incomplete permission checks in the `/api/v1/user/starred` and `/api/v1/user/times` endpoints. While a previous fix (CVE-2026-20800) addressed similar leaks in notifications, these 'sibling' endpoints still return data based on the user's historical relationship without verifying current repository access. Specifically, `getStarredRepos()` fails to filter the list of starred repositories against current permissions, and `ListMyTrackedTimes()` retrieves issue titles and states for any issue the user has logged time on, regardless of current access status. This allows a network-based attacker with a valid (but revoked-access) account to enumerate private repository names, clone URLs, and issue titles. The issue is resolved in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: patched: Version 1.27.0 released
- 2026-07-21: advisory: GitHub Advisory published