CVE-2026-58510

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.4 through 2026-05-16

Description When a public repository is changed to private via the REST API, watch records are not properly cleared. This occurs because the updateRepository() function, which is utilized by the PATCH /api/v1/repos/{owner}/{repo} endpoint, fails to call the ClearRepoWatches function, unlike the web UI path. Consequently, users whose access has been revoked can still see the now-private repository in the GET /api/v1/user/subscriptions?private=true endpoint, exposing sensitive metadata such as the repository description, default branch, language, and license list. Additionally, this issue allows the NumWatches counter to remain inflated and creates a potential for content leakage through future notification paths that may lack proper access checks.

Recommendations In the updateRepository() function within services/repository/repository.go, add a call to ClearRepoWatches immediately after ClearRepoStars when a repository is set to private. As a temporary mitigation, avoid using the PATCH /api/v1/repos/{owner}/{repo} endpoint to change repository visibility to private and use the web UI Settings instead.