What is GHSA-2vgv-hgv4-22mh?

GHSA-2vgv-hgv4-22mh is a security advisory published by GitHub Security Advisories with Low severity. Gitea improperly exposes issue and pull request titles

Which CVE IDs does GHSA-2vgv-hgv4-22mh cover?

GHSA-2vgv-hgv4-22mh covers the following CVE IDs: CVE-2026-20800. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-2vgv-hgv4-22mh?

GHSA-2vgv-hgv4-22mh affects 1 product, including: go/github.com/go-gitea/gitea:\u003c 1.25.4.

GHSA-2vgv-hgv4-22mhLow

Gitea improperly exposes issue and pull request titles

Vendor

GitHub Security Advisories

Published

January 23, 2026

Last Modified

January 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-20800 →

📋 Description

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

🎯 Affected products1

go/github.com/go-gitea/gitea:< 1.25.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-20800
https://github.com/go-gitea/gitea/pull/36339
https://blog.gitea.com/release-of-1.25.4
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
https://github.com/go-gitea/gitea/commit/67e75f30a83d2523cedc37ad7b03bcba66947833
https://github.com/advisories/GHSA-2vgv-hgv4-22mh