CVE-2018-1000803: Information Exposure in Gitea
Summary
CVE-2018-1000803: Gitea Exposes Private Email Addresses. Affects github.com/go-gitea/gitea versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that provides a lightweight interface for managing repositories, users, and organizations. It is written in Go and offers features similar to popular Git hosting platforms. The vulnerability identified as CVE-2018-1000803 affects Gitea versions prior to 1.5.1. This vulnerability allows for the exposure of users' private email addresses. Specifically, when a user watches a repository to receive email notifications, the emails received contain the other recipients' email addresses, even if they have set their email as private. The vulnerability has been classified as CWE-200.
Vulnerability Detail
The vulnerability in Gitea version prior to 1.5.1 allows for the exposure of users' private email addresses. This occurs when users watch a repository to receive email notifications. The emails received contain the email addresses of other recipients, even if they have set their email as private. This information exposure can lead to privacy breaches and potential misuse of users' email addresses. The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability identified as CVE-2018-1000803 in Gitea versions prior to 1.5.1 allows for the exposure of users' private email addresses. This information exposure can lead to privacy breaches and potential misuse of the email addresses. To mitigate this vulnerability, it is recommended to upgrade Gitea to version 1.5.1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
The impact of this vulnerability is the exposure of users' private email addresses. This can lead to privacy breaches and potential misuse of the email addresses.
You can use Vulert's playground at Vulert Scanner to check if your Gitea installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there is no specific workaround available for this vulnerability. It is recommended to upgrade Gitea to version 1.5.1 or later.
There are no known exploits for this vulnerability at the moment. However, it is important to address the vulnerability promptly to prevent any potential misuse of users' email addresses.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-f5fj-7265-jxhj/GHSA-f5fj-7265-jxhj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
