CVE-2026-0798

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-07998.7In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not CVE-2026-08007.2The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-08027.3An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalat CVE-2026-08038.8A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. T CVE-2026-08047.3An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege esca CVE-2026-08058.8An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to CVE-2026-08064.9The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 CVE-2026-08077.2The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is du CVE-2026-08085.3The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due CVE-2026-08096.3Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be g CVE-2026-08107.1A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. T CVE-2026-08115.4The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9.