CVE-2026-20800 — AI Deep Analysis Summary

🚨 **Essence**: When the Notification API returns details, **repository access permissions are not re-verified**. 📉 **Consequence**: After permissions are revoked, users can still view Issue and PR titles of private repos…

🔍 **CWE**: Missing Authorization Check. 📍 **Defect Point**: The Notification API **skips** real-time verification of the current user's repository access permissions when fetching details.

📦 **Component**: Gitea (a lightweight Git service developed in Go). 📅 **Version**: Affected versions are not explicitly listed, but **v1.25.4** has patched the issue. Please check versions lower than v1.25.4.

🕵️ **What hackers can do**: 1. View Issue titles of **private repositories**. 2. View Pull Request titles of **private repositories**. 3.…

🚪 **Exploitation Threshold**: **Low**. ✅ Requires an **authenticated** user identity. ✅ Requires the user to have **previously** had access permissions to the private repository. ❌ Does not require complex configuration …

💻 **Exp/PoC**: 📄 An official patch has been released (PR #36339). 🚫 There are currently **no** public reports of in-the-wild exploitation or ready-made exploit code.

🔎 **How to self-audit**: 1. Check if the Gitea version is < **v1.25.4**. 2. Audit the Notification API logic to confirm whether permissions are re-verified on every query. 3.…

🛡️ **Has the vendor fixed it?**: **Yes!** ✅ **Gitea v1.25.4** has been released. 🔗 Reference: [GitHub Security Advisory](https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q).

🛑 **What to do if no patch is available**: 1. **Upgrade immediately** to v1.25.4 or a higher version. 2. If upgrading is not possible, **regularly clean up** old notification data. 3.…

⚡ **Urgency**: **Medium Priority**. 🔴 Involves **private data leakage**, with high sensitivity. 🟢 Exploitation conditions are limited (requires old permissions + authentication), not a remote unauthenticated attack. 💡 **…