CVE-2026-20800
Medium · 4.3Gitea improperly exposes issue and pull request titles
CVSS
4.3
EPSS
0.4%
Published
Jan 23, 2026
CISA due date
—
The record
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | code.gitea.io/gitea | 0 | 1.25.4 |
| Go | github.com/go-gitea/gitea | 0 | 1.25.4 |
| Bitnami | gitea | 0 | 1.25.4 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea Same vulnerability
- GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks in… Also affects code.gitea.io/gitea
- GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to… Also affects code.gitea.io/gitea
- GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access… Also affects code.gitea.io/gitea
- GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea Also affects code.gitea.io/gitea
- GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started… Also affects code.gitea.io/gitea
- GO-2026-4370 Gitea does not properly validate project ownership in organization project operations in… Also affects code.gitea.io/gitea
- GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the… Also affects code.gitea.io/gitea