Live › vulnerability › CVE-2026-109844
Go to dashboardThe subscriptions endpoint returns name, description, clone URLs, owner and counters for every repository a user watches, without rechecking current access. A user who lost access to a private repository can still read its metadata through this endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a self-hosted or hosted repository service where users can watch private repositories and where permissions can be downgraded, such as through team changes. Instances with no private repositories, or where access is never revoked, are unlikely to expose anything meaningful.
No product ranges from the sources yet.
Unknown from the sources.
1.27.0 on the 1.x line or 28.0.0 on the 28.x line, which the sources say contain the fix.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-109844")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.