CVE-2026-58419 Details
Description
Notification API leaks private issue metadata after access revocation
A vulnerability in the Gitea Notification API allows users to access private issue and pull request metadata after their access to a private repository has been revoked. This issue is present in Gitea versions prior to 1.26.3. The vulnerability arises because, although the 'repository' field in notification responses is correctly nullified after access revocation, the 'subject' field remains accessible. The 'subject' field can contain private issue or pull request titles, repository-related URLs, issue or pull request states, and comment metadata. This leak not only exposes historical data but also ongoing activity if new comments are added while the notification remains unread.
Users can upgrade to Gitea version 1.26.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-44qc-pgvp-wx7v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38108 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.26.4 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-44qc-pgvp-wx7v | Gitea Limited | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | 1.26.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | Gitea Limited |