3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0798

CVE-2026-0798: Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0798

CVE-2026-0798:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows users who previously had access to a repository to continue receiving release notifications even after the repository is made private. This can lead to the disclosure of potentially sensitive information in the release titles and content.

The root cause of the vulnerability is twofold:

Failure to Clear Watches: When a repository is made private, the system did not clear the list of users who were 'watching' it. The repository.MakeRepoPrivate function in services/repository/repository.go was missing the logic to remove these watches.
Lack of Permission Checks: The mailer.MailNewRelease function in services/mailer/mail_release.go, which is responsible for sending release notifications, did not verify if the recipients still had access to the repository. It would send notifications to all watchers, including those who should no longer have access.

The patch addresses both of these issues. It modifies repository.MakeRepoPrivate to call a new function, ClearRepoWatches, which removes all watches from a repository when it is made private. Additionally, it updates mailer.MailNewRelease to include a permission check, ensuring that notifications are only sent to users who are authorized to view the release.

Vulnerable functions

repository.MakeRepoPrivate

services/repository/repository.go

This function is responsible for changing a repository's visibility to private. The vulnerability lies in the fact that this function did not clear existing watches on the repository. As a result, users who were watching the repository when it was public would continue to receive notifications even after it was made private. The patch adds a call to `ClearRepoWatches` to fix this.

mailer.MailNewRelease

services/mailer/mail_release.go

This function is responsible for sending email notifications for new releases. The vulnerability is that this function did not check if the recipients had the necessary permissions to view the release. It would send notifications to all watchers of the repository, regardless of whether they still had access after the repository was made private. The patch adds a permission check to ensure that only authorized users receive the notification.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.