CVE-2026-0798CWE-284

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Low · published January 22, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-01-22T22:01Z
EPSS history
Timeline
  • 22 JAN 22:01Z
    Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation
    cvelistv5