{"id":"GO-2026-6071","revision":"0654bf5a383c422fa4e158a4027351e3","records":[{"revision":"0654bf5a383c422fa4e158a4027351e3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6071","aliases":["CVE-2026-59766","GHSA-qf2f-qh6p-7v89"],"title":"Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev","description":"Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev","state":0,"publishedAt":"2026-07-27T15:32:45+00:00","modifiedAt":"2026-07-27T17:00:24.6346643+00:00","affected":[{"ecosystem":"Go","name":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.27.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","https://github.com/go-gitea/gitea/releases/tag/v1.27.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6071","license":"OSV · upstream source license applies","key":"osv:GO-2026-6071","identifiers":["GO-2026-6071","CVE-2026-59766","GHSA-qf2f-qh6p-7v89"]},"retained":false,"historicalAffected":[]}],"coverage":[]}