---
id: "CVE-2026-109844"
kind: "vulnerability"
aliases: ["CVE-2026-109844"]
title: "Repository API exposes private repo metadata after a user loses access"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["api", "git-hosting", "other", "self-hosted"]
not_affected_if: ["no-private-repos"]
published_at: "2026-10-18T19:16:33+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:39:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109844", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Repository API exposes private repo metadata after a user loses access

The subscriptions endpoint returns name, description, clone URLs, owner and counters for every repository a user watches, without rechecking current access. A user who lost access to a private repository can still read its metadata through this endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade to `1.27.0` on the 1.x line or `28.0.0` on the 28.x line, which the sources say contain the fix.
- The sources do not name the affected product, so confirm which build is in use.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109844

## From the sources

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_