Security readout for executives and security teams
Plain-English summary
CVE-2026-20800 is an information disclosure issue in Gitea. A user whose access to a private repository was revoked may still see issue and pull request titles through older notifications. This can expose sensitive project names, incident details, or business context, but the sources do not indicate code or full content disclosure.
Executive priority
Treat as a moderate-priority confidentiality issue. It is unlikely to disrupt service, but it can leak sensitive private repository metadata to former collaborators. Prioritize Gitea environments handling confidential engineering, customer, security, or merger-related work.
Technical view
Gitea’s notification API returns notification details without re-validating current repository permissions. The CVSS 3.1 score is 6.5, with network access, low complexity, required low privileges, no user interaction, and high confidentiality impact. The issue is categorized as CWE-200. Public references include a vendor advisory, patch pull request, and v1.25.4 release materials.
Likely exposure
Exposure is most relevant for Gitea instances with private repositories and users whose collaborator access has been revoked after receiving notifications. The provided affected-version data is incomplete, so teams should compare their deployed Gitea version against the vendor advisory and v1.25.4 release guidance.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Abuse requires an authenticated user with prior notifications tied to a private repository whose access was later removed. The impact is limited to issue and pull request titles exposed through notification details.
Researcher notes
Key uncertainty: the source bundle lists affected versions as “0” with default status unaffected, which is not actionable. Use the GitHub advisory, patch PR #36339, and v1.25.4 release notes for precise remediation status. Avoid assuming broader data exposure beyond notification issue and pull request titles.
Mitigation direction
- Review the Gitea advisory for affected-version and fixed-version details.
- Upgrade according to the Gitea v1.25.4 release guidance if applicable.
- Revoke or review stale notifications for users removed from private repositories.
- Audit private repository membership changes involving former collaborators.
Validation and detection
- Inventory all internet-accessible and internal Gitea instances.
- Confirm deployed Gitea versions against the vendor advisory and v1.25.4 release notes.
- Verify removed collaborators cannot view private repository notification details.
- Review logs for notification API access by recently revoked users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-20800 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security AdvisoryCVE reference · vendor-advisory
- GitHub Pull Request #36339CVE reference · patch
- Gitea v1.25.4 ReleaseCVE reference · release-notes
- Gitea v1.25.4 Release Blog PostCVE reference · release-notes
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.