Skip to content
Heist/ feed
Back to feed
Medium

Gitea watched repositories API disclosure after access revocation

Type: advisorySources: OSV

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-109844
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 16:43 UTC · Revision 1

Source evidence

Gitea watched repositories API disclosure after access revocation

core-osv · Original source

Published 18 Oct 2026, 18:57 UTC

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

osv:CVE-2026-109844
Complete source record
{
  "id": "5a0143bf97f514513ca5085259b36f54721000b07d42404254f26edf41242925",
  "url": "https://osv.dev/vulnerability/CVE-2026-109844",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea watched repositories API disclosure after access revocation",
    "summary": "`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.",
    "evidence": "osv:CVE-2026-109844",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-109844",
      "aliases": [
        "CVE-2026-109844",
        "GHSA-96gv-2xc4-4hxj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.26.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v28.2.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v28.1.0",
            "v28.0.0",
            "v29.0.0-dev",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109844.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:21.050386176Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-28.2.0/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109844.json",
        "https://github.com/go-gitea/gitea/releases/tag/v28.2.0",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-109844",
        "https://github.com/go-gitea/gitea/pull/38321",
        "https://github.com/go-gitea/gitea/pull/38390"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109844.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-109844",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 487326,
  "published_at": "2026-10-18T18:57:08.476+00:00"
}