https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 15:38:04 +0000 https://db.gcve.eu/vuln/bdu:2026-15789 bdu:2026-15789 https://db.gcve.eu/vuln/bdu:2026-15789 https://db.gcve.eu/vuln/cve-2026-59766 <p><strong>Affected:</strong> Gitea</p> <p>Gitea&#39;s starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.</p> <p><strong>Affected:</strong> Gitea</p> <p>Gitea&#39;s starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.</p> https://db.gcve.eu/vuln/cve-2026-59766