Gitea Notification API Repository Access Vulnerability

A vulnerability exists in Gitea's notification API, specifically in versions through 1.25.4. The issue arises because the API fails to re-validate repository access permissions when delivering notification details. As a result, users who have had their access to a private repository revoked can still see issue and pull request titles through notifications received prior to the access removal.

Impact

Exploitation of this vulnerability allows for unauthorized access to private repository information, specifically issue and pull request titles, after access has been revoked.

Remediation

Users can upgrade to Gitea version 1.26.0 or later, where this issue has been addressed.