CVE-2026-0798 is an improper access control vulnerability (CWE-284) identified in the Gitea open source Git server, which is used for hosting Git repositories. The issue arises when a repository's visibility is changed from public to private. Despite the change, users who previously watched the repository continue to receive release notification emails. These notifications include metadata such as release titles, tags, and potentially content details, which can disclose sensitive information to unauthorized users whose access has been revoked. The vulnerability stems from Gitea's failure to update or restrict notification recipients based on the current access permissions after the repository's visibility changes. The CVSS 3.1 base score is 3.5 (low severity), reflecting that the attack vector is network-based (email), requires low privileges (the user must have been a watcher before), and requires user interaction (reading the email). The impact is limited to confidentiality as no integrity or availability impacts are reported. There are no known exploits in the wild, and no patches or mitigation links are currently provided. This vulnerability highlights a gap in access control enforcement in notification mechanisms within Gitea, potentially leading to unintended information disclosure.

For European organizations using Gitea to manage private repositories, this vulnerability could lead to unauthorized disclosure of sensitive project information such as release details and code changes. While the impact is limited to confidentiality and does not affect system integrity or availability, leaking release metadata could aid adversaries in reconnaissance or intellectual property theft. Organizations with strict data privacy regulations, such as GDPR, may face compliance risks if sensitive information is inadvertently disclosed. The risk is higher for organizations that frequently change repository visibility or have many external collaborators who may have had prior access. However, since exploitation requires prior watcher status and user interaction, the overall risk is moderate to low. Still, sensitive projects or those involving regulated data should consider this a notable risk to their confidentiality posture.

European organizations should audit their Gitea instances to identify repositories recently changed from public to private and review the list of watchers or notification recipients. Temporarily disabling release notifications or customizing notification settings to exclude former watchers can reduce exposure. Administrators should monitor Gitea updates for patches addressing this vulnerability and apply them promptly once available. Implementing additional access control checks in notification workflows or using external notification systems with stricter access validation can help mitigate the issue. Educating users to recognize and report unexpected release notifications is also advisable. For critical repositories, consider restricting repository visibility changes or using alternative secure communication channels for release announcements until the vulnerability is resolved.