GHSA-44qc-pgvp-wx7v: Gitea: Notification API leaks private issue metadata after access revocation

Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the subject field remains accessible and continues to expose private metadata. Details CVE-2026-20800 was fixed in v1.25.4 to prevent users from accessing private repository information through notification APIs after their repository access had been revoked. During testing on Gitea v1.26.2, the repository field in NotificationThread responses is correctly set to null after access revocation. However, the associated subject field remains available. The exposed subject object may contain: - Private issue or pull request titles - Repository-related API and HTML URLs - Issue or pull request state - Latest comment URLs and comment identifiers Additionally, the exposed notification data is not limited to historical information. If new comments are added to the issue or pull request while the notification remains unread, fields such as latest_comment_url and updated_at continue to change. As a result, a user whose repository access has been revoked can still observe ongoing issue or pull request activity through notification APIs. The observed behavior suggests that access control is applied to the repository field but not consistently applied to the associated subject information. PoC Environment - Gitea v1.26.2 - Private repository Steps to Reproduce 1. User sun creates a private repository and grants read access to user li. 2. User li subscribes to repository notifications. 3. User sun creates a private issue and adds a comment. 4. User li receives a notification (thread_id = 14). 5. User sun revokes li's repository access. 6. User li requests: GET /api/v1/repos/sun/{repo}/issues/1 Response: 404 Not Found 7. User li requests: GET /api/v1/notifications?al