The vulnerability (CVE-2026-58510) arises because the fix for clearing repository watches on visibility change (public to private) was applied only to the web UI path (MakeRepoPrivate) but not to the API path (updateRepository) used by PATCH /api/v1/repos/{owner}/{repo}. Consequently, when a repository is made private via the API, watch records persist, allowing users without access to see the repository's metadata via the subscriptions endpoint and causing stale watch counts. The issue affects Gitea versions from v1.25.4 through versions before v1.27.0. The original fix mitigated release notification email leaks, but this residual issue remains due to incomplete code path coverage.

Users who previously watched a public repository that is made private via the API can still see the repository listed in their subscriptions with full metadata (description, default branch, language, license, counts, etc.) despite lacking access. This results in exposure of private repository metadata (CWE-200, CWE-359) and improper preservation of permissions (CWE-281). There is no impact on integrity or availability. The issue also causes inflated watcher counts on the repository. The release notification email leak vector is mitigated by a send-time mail filter added in the original fix.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid changing repository visibility from public to private via the REST API; instead, use the web UI path (Settings → Danger Zone) which correctly clears watch records. Monitor vendor communications for updates or patches addressing this issue.