---
id: CVE-2026-59766
aliases:
  - GHSA-qf2f-qh6p-7v89
title: >-
  Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads
  private repo objects via `/api/v1/user/starred` and private issue titles via
  `/api/v1/user/times`
summary: >-
  Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads
  private repo objects via `/api/v1/user/starred` and private issue titles via
  `/api/v1/user/times`
severity: medium
cvss: 4.3
cwe:
  - CWE-863
vendor: gitea
product: code.gitea.io/gitea
ecosystem: go
affected:
  - code.gitea.io/gitea < 1.27.0
patched:
  - code.gitea.io/gitea 1.27.0
published: '2026-07-21'
updated: '2026-07-21'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-qf2f-qh6p-7v89'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89'
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.27.0'
  - url: 'https://github.com/advisories/GHSA-qf2f-qh6p-7v89'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-21T20:54:27.540Z'
---

## Overview

## Summary
CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two
sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo
access at output time:
- `GET /api/v1/user/starred` — `getStarredRepos()` computes a per-repo permission but still lists every
  starred repo (no filtering), so the full repo object (`full_name`, `private`, `clone_url`, `ssh_url`)
  of a now-inaccessible private repo is returned.
- `GET /api/v1/user/times` — `ListMyTrackedTimes()` queries by `UserID` only and `LoadAttributes` brings
  in the issue (`title`, `state`), leaking private issue titles after revocation.

## Steps to reproduce
Using the provided reproduction materials, as a revoked user:
1. Control: `GET /api/v1/repos/admin/starred-test` → **404**.
2. `GET /api/v1/user/starred` → leaks `admin/starred-test`, `private:true`, `clone_url`.
3. `GET /api/v1/user/times` → leaks `issue.title = "SECRET: …"`, `state`.

(Runtime-confirmed on `gitea/gitea:1.25.4`. Oracle = planted sentinel title; no real secret exfiltrated.)

## Impact
A former collaborator can enumerate private repos they starred and read private issue titles they logged
time on, indefinitely after access revocation. Metadata only (no repo content / comment bodies). Low.

## Suggested remediation
1. `getStarredRepos`: drop (or minimally redact) repos where `permission.HasAnyUnitAccessOrPublicAccess()`
   is false for the caller.
2. `ListMyTrackedTimes`: filter tracked-time entries by current repo access.
3. Optionally clear a user's stars / time entries for a private repo on revocation.

## Credit
Reported as part of an incomplete-patch measurement study (responsible disclosure).

## Affected packages

- `code.gitea.io/gitea < 1.27.0`

## Remediation

Upgrade to a patched release:

- `code.gitea.io/gitea 1.27.0`