Read the docs
TI-2026-00581 Aliases CVE-2026-0798GHSA-8fwc-qjw5-rvgp

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Priority LOW 16CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix Fixed code.gitea.io/gitea (Go): 1.25.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiteaGitea Open Source Git Serverup to 1.25.3—No fix listedCNA
—code.gitea.io/gitea (Go)before 1.25.41.25.4Patch availableGHSA-8fwc-qjw5-rvgp
  • Gitea Open Source Git Server VendorGitea Affected up to 1.25.3 Fixed in — No fix listed CNA
  • code.gitea.io/gitea (Go) Vendor— Affected before 1.25.4 Fixed in 1.25.4 Patch available GHSA-8fwc-qjw5-rvgp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*before 1.25.4VulnerableGitea
  • cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:* Versions before 1.25.4 Vulnerable ·Gitea

Remediation

  • Fix · GHSA-8fwc-qjw5-rvgp code.gitea.io/gitea (Go) Fixed in 1.25.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • OpenShift Pipelines

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0798
  2. 2026-10-03 Alias added: GHSA-8fwc-qjw5-rvgp

References

Patch 1

Advisory 2

Other 4

  • TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-11072 The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote… CVSS 3.1HIGH 7.2
  • TI-2022-12910 Gitea before 1.16.7 does not escape git fetch remote. CVSS 3.1HIGH 7.5
  • TI-2019-08404 models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror… CVSS 3.1HIGH 8.8
  • TI-2022-00955 Open Redirect on login in go-gitea/gitea CVSS 3.1MEDIUM 6.1
  • TI-2026-68968 Push-to-create bypass of FORCE_PRIVATE policy in Gitea CVSS 3.1MEDIUM 5.4
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences