PT-2026-63316 · Gitea+1 · Gitea+1

CVE-2026-59766

·

Published

2026-07-21

·

Updated

2026-08-13

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4
Description A flaw allows users whose access has been revoked to continue accessing private information through specific endpoints. A former collaborator can enumerate private repositories they previously starred and read private issue titles they logged time on. This occurs because the system fails to re-verify repository access at the time of output.
API Endpoints:
  • '/api/v1/user/starred'
  • '/api/v1/user/times'
Function Names:
  • getStarredRepos()
  • ListMyTrackedTimes()
  • LoadAttributes
Recommendations For Gitea version 1.25.4:
  • Modify getStarredRepos() to drop or redact repositories where the caller does not have current access.
  • Update ListMyTrackedTimes() to filter tracked-time entries based on the user's current repository access.
  • As a temporary mitigation, restrict access to the '/api/v1/user/starred' and '/api/v1/user/times' endpoints for users with revoked permissions.

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-59766
GHSA-QF2F-QH6P-7V89
GO-2026-6071
OPENSUSE-SU-2026:21551-1
SUSE-SU-2026:23216-1
SUSE-SU-2026:23227-1

Affected Products

Gitea
Red Os