CVE-2026-109844: Gitea watched repositories API disclosure after access revocation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19
Weakness: CWE-862

Description

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

Affected products

Gitea Open Source Git Server: through 1.26.4

References

https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/38321
https://github.com/go-gitea/gitea/pull/38390
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj

Get alerted when CVE-2026-109844 or the next vulnerability affects your stack