CVE-2026-59766 Gitea private repository metadata disclosure after access revocation
Attackers with revoked access can retrieve private repository metadata and issue titles via starred and tracked-time API endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59766?
CVE-2026-59766 is a medium-severity vulnerability in Gitea, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.
Weakness: CWE-284
Which versions are affected by CVE-2026-59766?
3 open source packages ship an affected version, including code.gitea.io/gitea and gitea.dev.
| Package | Affected | Fixed in |
|---|---|---|
code.gitea.io/gitea Go | All versions | 1.27.0 |
code.gitea.io/gitea Go | All versions | 1.27.0 |
gitea.dev Go | All versions | 1.27.0 |
How do I fix CVE-2026-59766?
Upgrade code.gitea.io/gitea to 1.27.0 or later.
Is CVE-2026-59766 being exploited?
There is no known exploitation of CVE-2026-59766 in the wild and no public exploit code.
Sources
Also known as GHSA-qf2f-qh6p-7v89, GO-2026-6071, MINI-hhgx-cffh-3x62, MINI-jgwv-38gf-9whg.