CVE-2026-20800 — Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they m…
Published: 2026-01-22 · CVSS: 6.5 · CVSS 3.1
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7