GHSA-8fwc-qjw5-rvgp
Gitea may send release notification emails for private repositories to users whose access has been revoked
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.25.4 | 1.25.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.
References
External links from the advisory. They lead to third-party sites.