Access Control Vulnerability in Gitea by go-gitea
CVE-2026-109844

Currently unrated

Key Information:

Vendor: Gitea
Status: Gitea
Vendor: CVE Published:; 18 October 2026

What is CVE-2026-109844?

An access control issue in Gitea allows users who have lost permissions on private repositories to still access their metadata such as name, description, and clone URLs. This vulnerability arises when a user who was watching a private repository and subsequently loses access, perhaps due to a team permission downgrade, can still view sensitive information. Version 1.27.0 and 28.0.0 were vulnerable, but the issue has been resolved in version 28.2.0.