{"id":"CVE-2026-109844","aliases":["EUVD-2026-103988","GHSA-96gv-2xc4-4hxj"],"status":"published","title":"Gitea watched repositories API disclosure after access revocation","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00199,"percentile":0.09886,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-18T18:57:08Z","modified":"2026-10-28T02:30:21Z","products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38321","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/38390","tags":["patch","fix"]},{"url":"https://blog.gitea.com/release-of-28.2.0/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":["release-notes","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109844.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109844","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-109844","title":"Gitea watched repositories API disclosure after access revocation","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","status":"published","published":"2026-10-18T18:57:08.476Z","modified":"2026-10-19T20:16:31.969Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-103988","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","status":"published","published":"2026-10-18T18:57:08Z","modified":"2026-10-19T20:16:31Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:46.998284Z"}],"nvd":[{"id":"CVE-2026-109844","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","status":"published","published":"2026-10-18T19:16:33.09Z","modified":"2026-10-19T21:17:05.513Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:00.483792Z"}],"osv":[{"id":"CVE-2026-109844","title":"Gitea watched repositories API disclosure after access revocation","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","status":"published","published":"2026-10-18T18:57:08.476Z","modified":"2026-10-28T02:30:21.050386176Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:55.61515Z"}]}}