Is CVE-2026-59766 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59766?

CVE-2026-59766 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-59766

Description

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.