3.5

CVE-2026-0798

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitea ≫ Gitea SwPlatform- Version < 1.25.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.145
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://blog.gitea.com/release-of-1.25.4/
Release Notes
https://github.com/go-gitea/gitea/pull/36319
Patch
Issue Tracking
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-f4wq-6ww5-m56p
Broken Link