Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

## Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - `GET /api/v1/user/starred` — `getStarredRepos()` computes a per-repo permission but still lists every starred repo (no filtering), so the full repo object (`full_name`, `private`, `clone_url`, `ssh_url`) of a now-inaccessible private repo is returned. - `GET /api/v1/user/times` — `ListMyTrackedTimes()` queries by `UserID` only and `LoadAttributes` brings in the issue (`title`, `state`), leaking private issue titles after revocation. ## Steps to reproduce Using the provided reproduction materials, as a revoked user: 1. Control: `GET /api/v1/repos/admin/starred-test` → **404**. 2. `GET /api/v1/user/starred` → leaks `admin/starred-test`, `private:true`, `clone_url`. 3. `GET /api/v1/user/times` → leaks `issue.title = "SECRET: …"`, `state`. (Runtime-confirmed on `gitea/gitea:1.25.4`. Oracle = planted sentinel title; no real secret exfiltrated.) ## Impact A former collaborator can enumerate private repos they starred and read private issue titles they logged time on, indefinitely after access revocation. Metadata only (no repo content / comment bodies). Low. ## Suggested remediation 1. `getStarredRepos`: drop (or minimally redact) repos where `permission.HasAnyUnitAccessOrPublicAccess()` is false for the caller. 2. `ListMyTrackedTimes`: filter tracked-time entries by current repo access. 3. Optionally clear a user's stars / time entries for a private repo on revocation. ## Credit Reported as part of an incomplete-patch measurement study (responsible disclosure).

Source published

21 Jul 2026 20:13:03 UTC

Source modified

27 Jul 2026 17:11:25 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Publisher rating · MODERATE