FKIE_CVE-2026-20800

Vulnerability from fkie_nvd - Published: 2026-01-22 22:16 - Updated: 2026-06-17 10:17
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
References
88ee5874-cf24-4952-aea0-31affedb7ff2https://blog.gitea.com/release-of-1.25.4/Release Notes
88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/36339Issue Tracking, Patch
88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/releases/tag/v1.25.4Release Notes
88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7qBroken Link
Impacted products
Vendor Product Version
gitea gitea *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "DFCB7D74-331D-4582-AB41-113A25BE8FAA",
              "versionEndExcluding": "1.25.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gitea\u0027s notification API does not re-validate repository access permissions when returning notification details. After a user\u0027s access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications."
    },
    {
      "lang": "es",
      "value": "La API de notificaciones de Gitea no revalida los permisos de acceso al repositorio al devolver los detalles de la notificaci\u00f3n. Despu\u00e9s de que se revoque el acceso de un usuario a un repositorio privado, a\u00fan pueden ver los t\u00edtulos de las incidencias y las solicitudes de extracci\u00f3n a trav\u00e9s de notificaciones recibidas previamente."
    }
  ],
  "id": "CVE-2026-20800",
  "lastModified": "2026-06-17T10:17:48.227",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20800",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-23T21:11:32.615971Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-22T22:16:17.540",
  "references": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "tags": [
        "Release Notes"
      ],
      "url": "https://blog.gitea.com/release-of-1.25.4/"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/go-gitea/gitea/pull/36339"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q"
    }
  ],
  "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.