Gitea Notification API Private Metadata Leak Vulnerability

A vulnerability in the Gitea Notification API allows users to access private issue and pull request metadata after their access to a private repository has been revoked. This issue is present in Gitea versions prior to 1.26.3. The vulnerability arises because, although the 'repository' field in notification responses is correctly nullified after access revocation, the 'subject' field remains accessible. The 'subject' field can contain private issue or pull request titles, repository-related URLs, issue or pull request states, and comment metadata. This leak not only exposes historical data but also ongoing activity if new comments are added while the notification remains unread.

Impact

Exploitation of this vulnerability leads to unauthorized access to private issue and pull request information, including titles, URLs, states, and comment activity, after repository access has been revoked.

Reproduction

To reproduce this vulnerability, a user must first have access to a private repository and subscribe to its notification updates. After receiving a notification about a new comment on a private issue, the user can have their access revoked. Despite the revocation, the user can still access the notification thread, where the 'subject' field will contain private issue metadata, including the title and URLs related to the issue.

Remediation

Users can upgrade to Gitea version 1.26.3 or later, where this vulnerability has been fixed.