{"id":"CVE-2026-109844","published":"2026-10-18T19:16:33.090","lastModified":"2026-10-19T21:17:05.513","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38321","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38390","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/38321","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38390","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj","tags":[]}],"hasPoc":true,"ai":null}