CVE-2026-59766
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.