6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20800

CVE-2026-20800: Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20800

CVE-2026-20800:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-gitea/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the services/convert/notification.go file, specifically within the ToNotificationThread function. The original code did not re-verify a user's access rights to a repository when fetching notification details. It assumed that if a notification existed for a user, they still had valid permissions. The patch, identified in commit 67e75f30a83d2523cedc37ad7b03bcba66947833, rectifies this by adding an explicit permission check. It now calls access_model.GetUserRepoPermission to fetch the user's current permissions for the repository associated with the notification. Only if the user has any level of access (perm.HasAnyUnitAccessOrPublicAccess()) is the repository information, which contains potentially sensitive titles of issues and pull requests, included in the API response. This prevents users who have had their access revoked from continuing to see updates from private repositories.

Vulnerable functions

convert.ToNotificationThread

services/convert/notification.go

The function `ToNotificationThread` was responsible for converting a notification object into an API response. Before the patch, it would include repository information (including issue and pull request titles) without verifying if the user still had access to that repository. It incorrectly assumed that the existence of a notification implied the user had at least read access. The vulnerability was that if a user's access to a private repository was revoked, they could still see the titles of new issues and pull requests through the notification API. The patch introduces a permission check using `access_model.GetUserRepoPermission` to ensure the user currently has access before including the repository details in the response.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.