CVE-2026-20800: Gitea improperly exposes issue and pull… – CVSS 6.5 · Watchpost

← All vulnerabilities

Gitea improperly exposes issue and pull request titles

中危 6.5CVE-2026-20800 · BIT-gitea-2026-20800 · GHSA-2vgv-hgv4-22mh · Published 22/01/2026 · updated 17/06/2026

要点

CVE-2026-20800 是影响 code.gitea.io/gitea, github.com/go-gitea/gitea, gitea (gitea) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.41%，高于 34.9% 的漏洞。
修复：升级到 1.25.4 或更高版本。

Package	Affected versions	Patched versions
code.gitea.io/gitea Go	`< 1.25.4`	`1.25.4`
github.com/go-gitea/gitea Go	`< 1.25.4`	`1.25.4`
gitea gitea	`< 1.25.4`	`1.25.4`

Description

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

NVD description

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

References

nvd.nist.gov/vuln/detail/CVE-2026-20800 · ADVISORY
go-gitea/gitea#36339 · WEB
go-gitea/gitea commit 67e75f3 · WEB
blog.gitea.com/release-of-1.25.4 · WEB
go-gitea/gitea · PACKAGE
go-gitea/gitea release v1.25.4 · WEB
blog.gitea.com/release-of-1.25.4 · Release Notes
go-gitea/gitea security advisory · Broken Link
GitHub Advisory GHSA-2vgv-hgv4-22mh · ADVISORY

code.gitea.io/gitea 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free