CVE-2026-20800: 
Gitea vulnerability analysis and mitigation

CVE-2026-20800 is an information disclosure vulnerability in Gitea's notification API that fails to re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications. All Gitea versions prior to 1.25.4 are affected. The vulnerability was published on January 22, 2026, with a patch released on January 23, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Gitea's notification API (/api/v1/notifications and related thread endpoints) stores notification records tied to repository events but does not re-check whether the requesting user still has access to the associated repository at query time. An authenticated user whose repository access has been revoked can query the notification API and receive issue and pull request titles from the private repository they no longer have permission to access. The fix, implemented in pull request #36339 by contributor lunny, hides repository information from notification responses when the requesting user's access has been revoked (GitHub PR, GitHub Advisory).

Exploitation results in unauthorized disclosure of sensitive repository metadata — specifically issue and pull request titles from private repositories — to users whose access has been revoked. There is no impact on integrity or availability, and the vulnerability does not enable code execution or lateral movement. The scope is limited to information that was previously accessible to the user, meaning only titles of notifications received prior to access revocation are exposed, not new repository content (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.014% (5th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated account on the Gitea instance, limiting the attacker pool to former collaborators or users with revoked access (GitHub Advisory, Feedly).

1. Obtain prior access: The attacker must have previously been granted access to a private Gitea repository and received notifications (e.g., about issues or pull requests) during that period.
2. Have access revoked: The attacker's repository access is subsequently removed by an administrator or repository owner.
3. Authenticate to Gitea API: Using their still-valid Gitea account credentials or API token, the attacker authenticates to the Gitea instance.
4. Query the notification API: The attacker sends an authenticated GET request to the Gitea notification API endpoint (e.g., GET /api/v1/notifications or GET /api/v1/notifications/threads/{id}) to retrieve stored notifications.
5. Extract sensitive titles: The API response returns notification details including issue and pull request titles from the private repository, despite the user's access having been revoked, exposing potentially sensitive project information (GitHub PR, GitHub Advisory).

• Network: Authenticated API requests to /api/v1/notifications or /api/v1/notifications/threads/{id} from users who no longer have repository access; unusual API activity from accounts shortly after access revocation.
• Logs: Gitea access logs showing repeated notification API queries from accounts that have had their repository permissions removed; API calls returning HTTP 200 responses for notification threads linked to private repositories for revoked users.
• Application: Notification records in the Gitea database associated with private repositories being accessed by users no longer listed as collaborators.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability (commit 67e75f3, backported in PR #36387) (Gitea Release, GitHub Advisory). No configuration-based workaround is available; upgrading is the only remediation. Administrators should also audit notification logs to identify any unauthorized access that may have occurred, and consider reviewing the list of users recently revoked from private repositories.

The Gitea project addressed the vulnerability as part of the v1.25.4 security release, which bundled multiple security fixes (Gitea Blog). The fix was developed and merged by Gitea maintainer lunny with approval from maintainers lafriks and Zettat123. Community reaction has been minimal given the low severity and limited exploitability of the issue. The vulnerability was also flagged by the Go vulnerability database (golang/vulndb) shortly after disclosure (GitHub PR).