PT-2026-4285 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-0798

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea may send release notification emails for private repositories to users whose access has been revoked. This occurs when a repository is changed from public to private, potentially disclosing release titles, tags, and content to users who previously watched the repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-GITEA-2026-0798

CVE-2026-0798

GHSA-8FWC-QJW5-RVGP

GHSA-F4WQ-6WW5-M56P

GO-2026-4365

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 95

• https://github.com/go-gitea/gitea/pull/36319 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-f4wq-6ww5-m56p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8fwc-qjw5-rvgp · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-0798 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0798 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4365 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note
• https://suse.com/security/cve/CVE-2026-23992 · Note
• https://suse.com/security/cve/CVE-2026-20897 · Note