Is CVE-2026-59766 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59766 being exploited in the wild.

How severe is CVE-2026-59766?

Medium severity, with a CVSS score of 4.3, published 14 October 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-59766?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59766 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59766?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59766: Gitea incorrect authorization in starred repos and tracked times API

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-59766?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59766 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-59766?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59766 · Severity: medium · CVSS 4.3 · Published 2026-10-14

Gitea, a popular self-hosted Git service, contains a vulnerability where users who have had their access revoked can still view certain metadata about private projects. Specifically, a former collaborator can still see the names and URLs of private repositories they previously 'starred' and the titles of private issues they previously logged time on. While this does not allow access to the actual source code or file contents, it results in the unauthorized disclosure of project names and internal issue descriptions.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-59766 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59766 being exploited in the wild.
How severe is CVE-2026-59766?: Medium severity, with a CVSS score of 4.3, published 14 October 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-59766?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59766 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59766?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

An authorization bypass exists in Gitea's API due to incomplete permission checks in the `/api/v1/user/starred` and `/api/v1/user/times` endpoints. While a previous fix (CVE-2026-20800) addressed similar leaks in notifications, these 'sibling' endpoints still return data based on the user's historical relationship without verifying current repository access. Specifically, `getStarredRepos()` fails to filter the list of starred repositories against current permissions, and `ListMyTrackedTimes()` retrieves issue titles and states for any issue the user has logged time on, regardless of current access status. This allows a network-based attacker with a valid (but revoked-access) account to enumerate private repository names, clone URLs, and issue titles. The issue is resolved in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-59766
GHSA-qf2f-qh6p-7v89
GO-2026-6071

Timeline

2026-07-13: patched: Version 1.27.0 released
2026-07-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.