https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-24T18:34:55.809019+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/bdu:2026-15789 bdu:2026-15789 2026-10-24T18:34:55.810815+00:00 bdu:2026-15789 https://db.gcve.eu/vuln/cve-2026-59766 CVE-2026-59766 — Gitea private repository metadata disclosure after access revocation 2026-10-24T18:34:55.810851+00:00

Affected: Gitea

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.