CVE-2026-109844 — Gitea watched repositories API disclosure after access revocation
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a privat…
Published: 2026-10-18 · CVSS: 4.3 · CVSS 3.1
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7