https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:18:40.177025+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333343 EUVD-2026-333343 2026-10-03T18:18:40.231756+00:00 EUVD-2026-333343 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58419 fkie_cve-2026-58419 2026-10-03T18:18:40.231807+00:00

Notification API leaks private issue metadata after access revocation

 https://cve.radiocsirt.org/vuln/ghsa-44qc-pgvp-wx7v GHSA-44qc-pgvp-wx7v — Gitea: Notification API leaks private issue metadata after access revocation 2026-10-03T18:18:40.231851+00:00

Affected: Go: code.gitea.io/gitea

# Summary

An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject` field remains accessible and continues to expose private metadata.

# Details

CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked.

During testing on Gitea v1.26.2, the `repository` field in `NotificationThread` responses is correctly set to `null` after access revocation. However, the associated `subject` field remains available.

The exposed `subject` object may contain:

* Private issue or pull request titles * Repository-related API and HTML URLs * Issue or pull request state * Latest comment URLs and comment identifiers

Additionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as `latest_comment_url` and `updated_at` continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs.

The observed behavior suggests that access control is applied to the `repository` field but not consistently applied to the associat…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 WID-SEC-W-2026-2149 — Gitea: Mehrere Schwachstellen 2026-10-03T18:18:40.231977+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.