CVE-2026-59766
Deferred Deferred - Pending Action

Gitea API Privilege Escalation via Stale Permissions

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-59766
EUVD
EUVD-2026-101280

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 1.25.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Gitea's starred-repository and tracked-time API endpoints do not re-check repository permissions before returning data. This allows users whose access to private repositories has been revoked to still retrieve metadata like repository names, private status, and issue titles through /api/v1/user/starred and /api/v1/user/times endpoints.

Detection Guidance

Check Gitea API logs for repeated requests to /api/v1/user/starred or /api/v1/user/times from users whose repository access has been revoked. Monitor for unauthorized access attempts to private repository metadata or issue titles through these endpoints.

Impact Analysis

If you revoke a user's access to a private repository, they may still access metadata such as repository names, private status, clone URLs, and private issue titles where they logged time. This could lead to unauthorized information exposure even after revocation.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to private repository metadata after access revocation. It undermines access control measures and may lead to non-compliance with privacy regulations.

Mitigation Strategies
  • Upgrade Gitea to version 1.27 or later, which includes the security fixes addressing this vulnerability.
  • Review and revoke access for users no longer authorized to view private repositories.
  • Clear starred repositories and time entries for users whose access has been revoked to prevent data leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart