Gitea may send release notification emails for private repositories to users whose access has been revoked

GHSA-8fwc-qjw5-rvgp · BIT-gitea-2026-0798 · CVE-2026-0798 · GHSA-f4wq-6ww5-m56p · GO-2026-4365

Published Jan 23, 2026 · Modified Feb 3, 2026

Description

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-0798
WEB https://github.com/go-gitea/gitea/pull/36319
WEB https://blog.gitea.com/release-of-1.25.4
PACKAGE https://github.com/go-gitea/gitea
WEB https://github.com/go-gitea/gitea/releases/tag/v1.25.4

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes