CVE-2026-109844

Received Received - Intake

Information Disclosure in GitHub Enterprise Server

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-109844

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves an API endpoint (/api/v1/user/subscriptions) that exposed metadata of repositories a user previously watched, even after losing access. For example, if a user watched a private repository and later had their permissions revoked, they could still view details like the repository name, description, clone URLs, owner, and counters.

Detection Guidance

This vulnerability involves unauthorized access to private repository metadata after permission downgrades. To detect it, check Gitea server logs for unauthorized access attempts to the /api/v1/user/subscriptions endpoint. Verify if users can access repository metadata they no longer have permissions for by testing access controls manually.

Impact Analysis

This vulnerability could allow unauthorized users to access sensitive repository information, including names, descriptions, and clone URLs, even after their access was revoked. This may lead to data leaks or unauthorized access to private code.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive repository data to unauthorized users, potentially breaching GDPR (data protection) or HIPAA (privacy) regulations if the repositories contained protected information.

Mitigation Strategies

Upgrade Gitea to version 1.27.0, 28.0.0, or later to address the vulnerability. Review repository access permissions to ensure users no longer have unauthorized access to private repositories they previously watched.

Hi! I’m here to help you understand CVE-2026-109844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70