CVE-2026-58419: Notification API Information Disclosure

CVE-2026-58419 Overview

CVE-2026-58419 is an information disclosure vulnerability in Gitea, the self-hosted Git service. The Notification API continues to expose metadata for private issues after a user's access has been revoked. Authenticated users who previously had access to a private repository can still retrieve issue titles, repository names, and other metadata through the notification endpoint after their permissions are removed. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Gitea addressed the issue in versions 1.26.3 and 1.26.4.

Critical Impact
Attackers with previously granted access can enumerate private issue metadata from repositories they no longer have permission to view, compromising the confidentiality of internal project data.

Affected Products

Gitea versions prior to 1.26.3
Gitea versions prior to 1.26.4
Self-hosted Gitea instances exposing the Notification API

Discovery Timeline

2026-07-03 - CVE-2026-58419 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-58419

Vulnerability Analysis

The vulnerability resides in Gitea's Notification API, which returns notification records associated with a user account. Notification records include metadata references to source issues, pull requests, and repositories. When a repository owner or administrator revokes a user's access to a private repository, the notification records tied to that user are not purged or filtered against the current access control state.

As a result, the API continues to return references to private issues the user can no longer access directly. The disclosed metadata may include issue identifiers, titles, repository names, and timestamps. This exposes information about internal projects, upcoming features, security issues tracked as private, and organizational structure.

The flaw exists because authorization checks are performed at the point of notification generation rather than at read time. Once a notification is stored, the API does not re-validate whether the requesting user still holds permission to view the referenced object.

Root Cause

The root cause is a missing runtime authorization check in the Notification API response handler. The endpoint trusts the historical association between user and notification without confirming current repository permissions. This is a classic broken access control pattern where authorization state and stored data drift apart over time.

Attack Vector

An attacker requires an authenticated Gitea account that previously received notifications from a private repository. After access revocation, the attacker queries the Notification API and parses the returned metadata. No user interaction or elevated privileges are required beyond the initial authenticated session. Exploitation is network-based and low complexity.

The vulnerability manifests in the notification query logic within Gitea. See the GitHub Security Advisory GHSA-44qc-pgvp-wx7v and the Gitea Pull Request Update for the technical fix details.

Detection Methods for CVE-2026-58419

Indicators of Compromise

Notification API requests to /api/v1/notifications from user accounts whose repository access was recently revoked.
Repeated polling of the notification endpoint from a single user session, particularly at high frequency.
API access patterns showing users retrieving notification data for repositories they no longer appear in as collaborators.

Detection Strategies

Correlate repository permission change events with subsequent notification API access from the same user account.
Enable Gitea access logging and alert on notification endpoint queries following collaborator removal events.
Review audit logs for anomalous read patterns against /api/v1/notifications outside typical user behavior baselines.

Monitoring Recommendations

Ingest Gitea application and access logs into a centralized log platform for correlation with identity and access management events.
Track the ratio of notification API calls to repository access events per user to identify outliers.
Alert on any bulk notification enumeration originating from accounts flagged as departed or restricted.

How to Mitigate CVE-2026-58419

Immediate Actions Required

Upgrade Gitea to version 1.26.4 or later, which contains the authorization fix.
Audit historical notification data and consider purging notifications tied to revoked repository access.
Review recent permission changes and identify accounts that may have queried the Notification API after access removal.

Patch Information

Gitea released fixed versions 1.26.3 and 1.26.4 addressing this issue. The corresponding change is tracked in Gitea Pull Request 38108 and released under the Gitea 1.26.4 Release Tag. Refer to the Gitea Release Announcement for full release notes.

Workarounds

Restrict Notification API access at the reverse proxy layer for user accounts pending removal.
Manually clear stored notifications when revoking collaborator access from private repositories.
Rotate access tokens for users whose repository permissions have been recently revoked to force re-authentication.

bash

# Upgrade Gitea to the patched release
docker pull gitea/gitea:1.26.4
docker stop gitea && docker rm gitea
docker run -d --name=gitea -p 3000:3000 -p 222:22 \
  -v /var/lib/gitea:/data gitea/gitea:1.26.4

# Verify the running version
curl -s http://localhost:3000/api/v1/version