CVE-2026-59766mediumCWE-284

CVE-2026-59766: fallo de gravedad media en Gitea

Gitea private repository metadata disclosure after access revocation

Publicada el

Seguir esta CVE+ Monitorear Gitea+ Monitorear code.gitea.io/gitea

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.3%
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Gitea · Gitea
CVEs relacionadas — Gitea

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-60004CRITICALCVE-2026-60004EPSS 24.0%KEVCVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2019-1010314—CVE-2019-1010314EPSS 0.8%CVE-2019-1010261—CVE-2019-1010261EPSS 0.8%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%