{"id":"CVE-2026-109844","kind":"vulnerability","aliases":["CVE-2026-109844"],"related":[],"title":"Repository API exposes private repo metadata after a user loses access","description":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.","summary":"The subscriptions endpoint returns name, description, clone URLs, owner and counters for every repository a user watches, without rechecking current access. A user who lost access to a private repository can still read its metadata through this endpoint.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","git-hosting","other","self-hosted"],"not_affected_if":["no-private-repos"],"how_to_check":null,"fix":"- Upgrade to `1.27.0` on the 1.x line or `28.0.0` on the 28.x line, which the sources say contain the fix.\n- The sources do not name the affected product, so confirm which build is in use.","status":"open","published_at":"2026-10-18T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:39:51+00:00","updated_at":"2026-10-25T04:39:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:39:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.27.0` on the 1.x line or `28.0.0` on the 28.x line, which the sources say contain the fix.\n- The sources do not name the affected product, so confirm which build is in use.","reach":"internet","title":"Repository API exposes private repo metadata after a user loses access","impact":"medium","summary":"The subscriptions endpoint returns name, description, clone URLs, owner and counters for every repository a user watches, without rechecking current access. A user who lost access to a private repository can still read its metadata through this endpoint.","category":"other","nicknames":[],"who_cares":["self-hosted","git-hosting","api"],"confidence":0.6,"needs_auth":"yes","worst_case":"Former collaborators read private repository names, descriptions and clone URLs","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-private-repos"],"who_is_affected":"Teams running a self-hosted or hosted repository service where users can watch private repositories and where permissions can be downgraded, such as through team changes. Instances with no private repositories, or where access is never revoked, are unlikely to expose anything meaningful.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001029,"input_tokens":3348,"output_tokens":1389,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109844':14A,17A '-2026':13A,16A '/api/v1/user/subscriptions':65C '1.27.0':123C '28.0.0':125C '28.2.0':129C 'access':11A,46B,51B,83C,95C 'api':2A,18B 'check':77C 'clone':32B,113C 'could':107C 'counter':36B,117C 'current':45B 'cve':12A,15A 'descript':31B,112C 'disclos':127C 'downgrad':106C 'endpoint':28B,63B 'everi':38B,70C 'exampl':101C 'expos':3A 'fix':121C 'get':64C 'git':20B 'git-host':19B 'host':21B,25B 'issu':119C 'later':97C 'lose':10A 'lost':50B,98C 'metadata':6A,60B,68C 'name':30B,111C 'owner':34B,115C 'permiss':105C 'privat':4A,54B,91C 'read':58B,109C 'recheck':44B 'repo':5A 'repositori':1A,39B,55B,71C,92C 'return':29B,66C 'self':24B 'self-host':23B 'still':57B,81C,108C 'subscript':27B 'team':104C 'url':33B,114C 'user':9A,41B,48B,73C,80C,87C 'watch':42B,75C,89C 'without':43B,76C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted or hosted repository service where users can watch private repositories and where permissions can be downgraded, such as through team changes. Instances with no private repositories, or where access is never revoked, are unlikely to expose anything meaningful.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109844","severity":null,"published_at":"2026-10-18T19:16:33+00:00","modified_at":"2026-10-19T21:17:05+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}