Listen to this Post
This vulnerability operates within Gitea’s notification system for repository releases. When a user “watches” a public repository, they are subscribed to notifications, including emails for new releases. The flaw occurs during the repository’s transition from public to private. While direct access permissions are correctly revoked for unauthorized users, the watcher subscription list is not fully purged. Subsequently, when a maintainer creates a new release, the system iterates through all watchers to send notification emails. It checks the user’s current read permissions for the repository at the time of sending, but this check can fail or be bypassed due to a race condition or cached permission state. Consequently, a user who no longer has any access to the now-private repository receives an email containing metadata about the new release, such as its , tag name, and the first line of the release notes, leading to unauthorized information disclosure.
Platform: Gitea
Version: <= 1.21.x
Vulnerability: Information Disclosure
Severity: Low
Date: 2026-01-23
Prediction: Patch 2026-02-06
What Undercode Say:
!/bin/bash
Check Gitea version
gitea –version
Example vulnerable version string: Gitea version 1.21.0
How Exploit:
1. UserA watches PublicRepo.
2. Admin sets PublicRepo to private.
3. UserA access is revoked.
4. Admin creates new release “SecretLaunch”.
5. UserA receives email with “SecretLaunch” details.
Protection from this CVE
- Upgrade to patched version.
- Audit notification lists.
gitea admin user list-repos –username
Impact:
- Release leak.
- Tag name exposure.
- Note snippet disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
