{"id":"CVE-2026-59766","title":"Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user","summary":"Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still re…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-284","CWE-863"],"vendor":"gitea","product":"code.gitea.io/gitea","affected":["code.gitea.io/gitea < 1.27.0"],"patched":["code.gitea.io/gitea 1.27.0"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:17:46.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59766","references":[{"url":"https://github.com/go-gitea/gitea/pull/38324","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0"},{"url":"https://github.com/advisories/GHSA-qf2f-qh6p-7v89"}],"tags":["nvd","ghsa","go","cve.org"],"aliases":["GHSA-qf2f-qh6p-7v89"],"ecosystem":"go","ingestedAt":"2026-07-21T20:54:27.540Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-14T15:31:00.508506Z"},"epss":0.00281,"epssPercentile":0.20489,"slug":"CVE-2026-59766","body":"## Overview\n\nGitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-59766)\n\nAffected packages:\n\n- `code.gitea.io/gitea < 1.27.0`\n\nPatched in:\n\n- `code.gitea.io/gitea 1.27.0`\n\nSource: https://github.com/advisories/GHSA-qf2f-qh6p-7v89","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}