What is GHSA-8fwc-qjw5-rvgp?

GHSA-8fwc-qjw5-rvgp is a security advisory published by GitHub Security Advisories with Low severity. Gitea may send release notification emails for private repositories to users whose access has been revoked

Which CVE IDs does GHSA-8fwc-qjw5-rvgp cover?

GHSA-8fwc-qjw5-rvgp covers the following CVE IDs: CVE-2026-0798. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-8fwc-qjw5-rvgp?

GHSA-8fwc-qjw5-rvgp affects 1 product, including: go/code.gitea.io/gitea:\u003c 1.25.4.

GHSA-8fwc-qjw5-rvgpLow

Gitea may send release notification emails for private repositories to users whose access has been revoked

Vendor

GitHub Security Advisories

Published

January 23, 2026

Last Modified

January 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-0798 →

📋 Description

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

🎯 Affected products1

go/code.gitea.io/gitea:< 1.25.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-0798
https://github.com/go-gitea/gitea/pull/36319
https://blog.gitea.com/release-of-1.25.4
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
https://github.com/advisories/GHSA-8fwc-qjw5-rvgp