Missing Authorization in Gitea - CVE-2026-109844
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to retrieve private repository metadata after losing access through a team permission downgrade.
The vulnerability exists due to missing authorization checks in Gitea's getWatchedRepos function in routers/api/v1/user/watch.go when listing watched repositories after team permissions are downgraded. A remote user can send a GET /api/v1/user/subscriptions request with a user-scoped token while remaining a team member to retrieve metadata for private repositories watched while access was still permitted.
The disclosure excludes repository content, including source code, issue bodies, pull request text, comments, commits, and secrets. Returned clone URLs do not grant repository access.