Summary
Gitea: Notification API leaks private issue metadata after access revocation
An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the subject field remains accessible and continues to expose private metadata.
Details
CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked.
During testing on Gitea v1.26.2, the repository field in NotificationThread responses is correctly set to null after access revocation. However, the associated subject field remains available.
The exposed subject object may contain:
- Private issue or pull request titles
- Repository-related API and HTML URLs
- Issue or pull request state
- Latest comment URLs and comment identifiers
Additionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as latest_comment_url and updated_at continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs.
The observed behavior suggests that access control is applied to the repository field but not consistently applied to the associated subject information.
PoC
Environment
- Gitea v1.26.2
- Private repository
Steps to Reproduce
User
suncreates a private repository and grants read access to userli.User
lisubscribes to repository notifications.User
suncreates a private issue and adds a comment.User
lireceives a notification (thread_id = 14).User
sunrevokesli's repository access.User
lirequests:GET /api/v1/repos/sun/{repo}/issues/1Response:
404 Not FoundUser
lirequests:GET /api/v1/notifications?all=trueUser
lirequests:GET /api/v1/notifications/threads/14
Observed Result
The notification is returned successfully. The repository field is null, but the subject field still contains private issue metadata.
Example:
{
"id": 14,
"repository": null,
"subject": {
"title": "private issue title",
"url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/1",
"latest_comment_url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/comments/24",
"html_url": "http://localhost:3000/sun/private-repo/issues/1",
"state": "open"
}
}
Expected Result
Users who no longer have access to a repository should not receive private issue or pull request information through notification APIs. The subject field should be removed, redacted, or otherwise protected by the same access controls applied to the repository field.
Detailed PoC
https://anonymous.4open.science/r/Gitea_PoC-EC93/1_poc_notification_leak
Impact
Affected Endpoints
GET /api/v1/notificationsGET /api/v1/notifications/threads/{id}
Prerequisites
- The user previously had legitimate access to the private repository.
- The notification was received before repository access was revoked.
Impact
- Disclosure of private issue or pull request titles.
- Disclosure of repository information through notification URLs.
- Disclosure of issue or pull request state.
- Disclosure of comment activity metadata.
- Continued visibility into issue or pull request activity after repository access has been revoked.
Tested Version
- Confirmed on v1.26.2.
CVE-2026-58419 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.26.4); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-58419? CVE-2026-58419 is a high-severity security vulnerability in code.gitea.io/gitea (go), affecting versions < 1.26.3. It is fixed in 1.26.4.
- How severe is CVE-2026-58419? CVE-2026-58419 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of code.gitea.io/gitea are affected by CVE-2026-58419? code.gitea.io/gitea (go) versions < 1.26.3 is affected.
- Is there a fix for CVE-2026-58419? Yes. CVE-2026-58419 is fixed in 1.26.4. Upgrade to this version or later.
- Is CVE-2026-58419 exploitable, and should I be worried? Whether CVE-2026-58419 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-58419 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-58419? Upgrade
code.gitea.io/giteato 1.26.4 or later.