CVE-2026-59766 affects Gitea before version 1.27.0. It is a follow-up issue to CVE-2026-20800, where the fix only covered the notification endpoint. Two sibling endpoints, /api/v1/user/starred and /api/v1/user/times, fail to re-validate repository access permissions when returning data keyed on the caller's relationship. As a result, revoked users can still retrieve full repository objects (including full_name, private flag, clone_url, ssh_url) for private repos they previously starred, and private issue titles for issues they logged time on. The vulnerability leaks metadata only, not repository content or comments. The issue was confirmed on Gitea 1.25.4 and reported responsibly as part of an incomplete-patch study.

A revoked user who previously had access to private repositories can indefinitely enumerate private repositories they starred and read private issue titles associated with their tracked time entries. The information leaked is limited to metadata such as repository names, clone URLs, and issue titles, without exposing actual repository content or issue comment bodies. This could lead to unauthorized disclosure of sensitive project metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Suggested remediation includes modifying the getStarredRepos function to exclude or redact repositories where the caller lacks access permissions, and filtering tracked-time entries in ListMyTrackedTimes by current repository access. Optionally, clearing a user's stars and time entries for private repositories upon access revocation can further reduce exposure. Since no official patch or fix link is provided, users should monitor Gitea advisories for updates and apply fixes once available.