Gitea: Notification API leaks private issue metadata after access revocation

• Gitea v1.26.2
• Private repository

1. User sun creates a private repository and grants read access to user li.

2. User li subscribes to repository notifications.

3. User sun creates a private issue and adds a comment.

4. User li receives a notification (thread_id = 14).

5. User sun revokes li's repository access.

6. User li requests:

   text복사

    1GET /api/v1/repos/sun/{repo}/issues/1

   Response:

   text복사

    1404 Not Found

7. User li requests:

   text복사

    1GET /api/v1/notifications?all=true

8. User li requests:

   text복사

    1GET /api/v1/notifications/threads/14

The notification is returned successfully. The repository field is null, but the subject field still contains private issue metadata.

Example:

 1{
 2  "id": 14,
 3  "repository": null,
 4  "subject": {
 5    "title": "private issue title",
 6    "url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/1",
 7    "latest_comment_url": "http://localhost:3000/api/v1/repos/sun/private-repo/issues/comments/24",
 8    "html_url": "http://localhost:3000/sun/private-repo/issues/1",
 9    "state": "open"
10  }
11}

Users who no longer have access to a repository should not receive private issue or pull request information through notification APIs. The subject field should be removed, redacted, or otherwise protected by the same access controls applied to the repository field.

https://anonymous.4open.science/r/Gitea_PoC-EC93/1_poc_notification_leak

Impact

Affected Endpoints

• GET /api/v1/notifications
• GET /api/v1/notifications/threads/{id}

Prerequisites

• The user previously had legitimate access to the private repository.
• The notification was received before repository access was revoked.

Impact

• Disclosure of private issue or pull request titles.
• Disclosure of repository information through notification URLs.
• Disclosure of issue or pull request state.
• Disclosure of comment activity metadata.
• Continued visibility into issue or pull request activity after repository access has been revoked.

Tested Version

• Confirmed on v1.26.2.