GHSA-44QC-PGVP-WX7V高危已审查

Gitea: Notification API leaks private issue metadata after access revocation

OSV 1.4.0 · github-reviewed · 修改于 2026-07-22 05:48

发布时间

2026-07-22 05:48

GitHub 审查时间

2026-07-22 05:48

NVD 发布时间

2026-07-04 05:17

源文件

advisories/github-reviewed/2026/07/GHSA-44qc-pgvp-wx7v/GHSA-44qc-pgvp-wx7v.json

公告说明

Summary

An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the subject field remains accessible and continues to expose private metadata.

Details

CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked.

During testing on Gitea v1.26.2, the repository field in NotificationThread responses is correctly set to null after access revocation. However, the associated subject field remains available.

The exposed subject object may contain:

Private issue or pull request titles
Repository-related API and HTML URLs
Issue or pull request state
Latest comment URLs and comment identifiers

Additionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as latest_comment_url and updated_at continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs.

The observed behavior suggests that access control is applied to the repository field but not consistently applied to the associated subject information.

PoC

Environment

Gitea v1.26.2
Private repository

Steps to Reproduce

User sun creates a private repository and grants read access to user li.
User li subscribes to repository notifications.
User sun creates a private issue and adds a comment.

标识信息

别名 / CVE

CVE-2026-58419

CWE

CWE-200

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-44qc-pgvp-wx7v",
  "aliases": [
    "CVE-2026-58419"
  ],
  "details": "# Summary\n\nAn information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject` field remains accessible and continues to expose private metadata.\n\n# Details\n\nCVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked.\n\nDuring testing on Gitea v1.26.2, the `repository` field in `NotificationThread` responses is correctly set to `null` after access revocation. However, the associated `subject` field remains available.\n\nThe exposed `subject` object may contain:\n\n* Private issue or pull request titles\n* Repository-related API and HTML URLs\n* Issue or pull request state\n* Latest comment URLs and comment identifiers\n\nAdditionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as `latest_comment_url` and `updated_at` continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs.\n\nThe observed behavior suggests that access control is applied to the `repository` field but not consistently applied to the associated `subject` information.\n\n# PoC\n\n## Environment\n\n* Gitea v1.26.2\n* Private repository\n\n## Steps to Reproduce\n\n1. User `sun` creates a private repository and grants read access to user `li`.\n\n2. User `li` subscribes to repository notifications.\n\n3. User `sun` creates a private issue and adds a comment.\n\n4. User `li` receives a notification (`thread_id = 14`).\n\n5. User `sun` revokes `li`'s repository access.\n\n6. User `li` requests:\n\n   ```http\n   GET /api/v1/repos/sun/{repo}/issues/1\n   ```\n\n   Response:\n\n   ```text\n   404 Not Found\n   ```\n\n7. User `li` requests:\n\n   ```http\n   GET /api/v1/notifications?all=true\n   ```\n\n8. User `li` requests:\n\n   ```http\n   GET /api/v1/notifications/threads/14\n   ```\n\n## Observed Result\n\nThe notification is returned successfully. The `repository` field is `null`, but the `subject` field still contains private issue metadata.\n\nExample:\n\n```json\n{\n  \"id\": 14,\n  \"repository\": null,\n  \"subject\": {\n    \"title\": \"private issue title\",\n    \"url\": \"http://localhost:3000/api/v1/repos/sun/private-repo/issues/1\",\n    \"latest_comment_url\": \"http://localhost:3000/api/v1/repos/sun/private-repo/issues/comments/24\",\n    \"html_url\": \"http://localhost:3000/sun/private-repo/issues/1\",\n    \"state\": \"open\"\n  }\n}\n```\n\n## Expected Result\n\nUsers who no longer have access to a repository should not receive private issue or pull request information through notification APIs. The `subject` field should be removed, redacted, or otherwise protected by the same access controls applied to the `repository` field.\n\n## Detailed PoC\n\nhttps://anonymous.4open.science/r/Gitea_PoC-EC93/1_poc_notification_leak\n\n# Impact\n\n**Affected Endpoints**\n\n* `GET /api/v1/notifications`\n* `GET /api/v1/notifications/threads/{id}`\n\n**Prerequisites**\n\n* The user previously had legitimate access to the private repository.\n* The notification was received before repository access was revoked.\n\n**Impact**\n\n* Disclosure of private issue or pull request titles.\n* Disclosure of repository information through notification URLs.\n* Disclosure of issue or pull request state.\n* Disclosure of comment activity metadata.\n* Continued visibility into issue or pull request activity after repository access has been revoked.\n\n**Tested Version**\n\n* Confirmed on v1.26.2.",
  "summary": "Gitea: Notification API leaks private issue metadata after access revocation",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.4"
            }
          ]
        }
      ],
      "package": {
        "name": "code.gitea.io/gitea",
        "ecosystem": "Go"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 1.26.3"
      }
    }
  ],
  "modified": "2026-07-21T21:48:05Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-07-21T21:48:05Z",
  "references": [
    {
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-44qc-pgvp-wx7v",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58419",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/go-gitea/gitea/pull/38108",
      "type": "WEB"
    },
    {
      "url": "https://github.com/go-gitea/gitea/commit/9e84deb969aff5c1115c2984e41250f28c78451f",
      "type": "WEB"
    },
    {
      "url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/go-gitea/gitea",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.4",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-07-03T21:17:05Z",
    "github_reviewed_at": "2026-07-21T21:48:05Z"
  }
}