CVE-2026-0798: 
Gitea vulnerability analysis and mitigation

CVE-2026-0798 is an improper access control vulnerability in Gitea that causes release notification emails for private repositories to be sent to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content. All Gitea versions prior to 1.25.4 are affected. The vulnerability was disclosed on January 22, 2026, with a patch released on January 23, 2026. It carries a CVSS v3.1 base score of 3.5 (Low) (Github Advisory, Feedly).

The root cause is classified as CWE-284 (Improper Access Control): when a repository's visibility is changed from public to private, Gitea failed to clean up existing watch subscriptions for users who no longer have access, and did not perform permission checks before sending release notification emails (Github Advisory). The fix, implemented in pull request #36319, addresses both issues by cleaning watches when a repository is made private and adding permission checks in the release email mailer (services/mailer/mail_release.go) (Gitea PR). Exploitation requires that a user previously watched a public repository before it was converted to private, and that a new release is published after the conversion — no active attacker action is needed beyond having previously watched the repository.

The primary impact is confidentiality: unauthorized users who previously watched a now-private repository will receive release notification emails containing release titles, tag names, and release body content that they should no longer be able to access (Github Advisory). There is no integrity or availability impact. The scope is limited to information disclosure of release metadata; it does not expose source code, credentials, or allow any modification of repository data. Organizations that rely on repository privacy to protect sensitive release information (e.g., pre-announcement product details, internal versioning) are most at risk.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is passive in nature — a former watcher simply receives emails they should not, without any active exploitation step required. The EPSS score is approximately 0.016–0.017%, placing it in the 4th percentile for exploitation likelihood (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

Upgrade Gitea to version 1.25.4 or later, which cleans watch subscriptions when a repository is made private and enforces permission checks before sending release notification emails (Gitea Release, Gitea Blog). Gitea Cloud instances are automatically upgraded during the maintenance window. As a workaround for administrators unable to upgrade immediately, manually review and remove watch subscriptions for users who should no longer have access to repositories that have been converted from public to private, and audit release notification subscriptions for all private repositories (Github Advisory).

The Gitea project published a release blog post announcing v1.25.4 as a security release addressing this and several other vulnerabilities (Gitea Blog). The vulnerability received routine coverage in vulnerability tracking feeds and databases, with no notable researcher commentary or significant community discussion beyond standard disclosure channels.