Notification API leaks private issue metadata after access revocation

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Notification API leaks private issue metadata after access revocation

Source published

3 Jul 2026 20:54:51 UTC

Source modified

6 Jul 2026 15:14:06 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

Notification API leaks private issue metadata after access revocation

Source published

Jul 3, 2026, 8:54:51 PM (timezone not stated)

Source modified

Jul 6, 2026, 3:14:06 PM (timezone not stated)

Observed here

7 Nov 2026 13:23:50 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Notification API leaks private issue metadata after access revocation

Source published

3 Jul 2026 21:17:05 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 15:15:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject` field remains accessible and continues to expose private metadata. # Details CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked. During testing on Gitea v1.26.2, the `repository` field in `NotificationThread` responses is correctly set to `null` after access revocation. However, the associated `subject` field remains available. The exposed `subject` object may contain: * Private issue or pull request titles * Repository-related API and HTML URLs * Issue or pull request state * Latest comment URLs and comment identifiers Additionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as `latest_comment_url` and `updated_at` continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs. The observed behavior suggests that access control is applied to the `repository` field but not consistently applied to the associated `subject` information. # PoC ## Environment * Gitea v1.26.2 * Private repository ## Steps to Reproduce 1. User `sun` creates a private repository and grants read access to user `li`. 2. User `li` subscribes to repository notifications. 3. User `sun` creates a private issue and adds a comment. 4. User `li` receives a notification (`thread_id = 14`). 5. User `sun` revokes `li`'s repository access. 6. User `li` requests: ```http GET /api/v1/repos/sun/{repo}/issues/1 ``` Response: ```text 404 Not Found ``` 7. User `li` requests: ```http GET /api/v1/notifications?all=true ``` 8. User `li` requests: ```http GET /api/v1/notifications/threads/14 ``` ## Observed Result The notification is returned successfully. The `repository` field is `null`, but the `subject` field still contains private issue metadata. Example: ```json { "id": 14, "repository": null, "subject": { "title": "private issue title", "url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/1", "latest_comment_url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/comments/24", "html_url": "http://localhost:3000/sun/private-repo/issues/1", "state": "open" } } ``` ## Expected Result Users who no longer have access to a repository should not receive private issue or pull request information through notification APIs. The `subject` field should be removed, redacted, or otherwise protected by the same access controls applied to the `repository` field. ## Detailed PoC https://anonymous.4open.science/r/Gitea_PoC-EC93/1_poc_notification_leak # Impact **Affected Endpoints** * `GET /api/v1/notifications` * `GET /api/v1/notifications/threads/{id}` **Prerequisites** * The user previously had legitimate access to the private repository. * The notification was received before repository access was revoked. **Impact** * Disclosure of private issue or pull request titles. * Disclosure of repository information through notification URLs. * Disclosure of issue or pull request state. * Disclosure of comment activity metadata. * Continued visibility into issue or pull request activity after repository access has been revoked. **Tested Version** * Confirmed on v1.26.2.

Source published

21 Jul 2026 21:48:05 UTC

Source modified

22 Jul 2026 21:11:39 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Publisher rating · HIGH

Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea

Source published

22 Jul 2026 20:36:35 UTC

Source modified

22 Jul 2026 21:00:26 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.