fix(security): harden access checks and migration validation (#38324)

Harden access checks for issue dependencies, team repository membership,
notifications, stars, tracked times and repository migrations.

routers/web/user/notification.go

@@ -4,6 +4,7 @@
 package user
 
 import (
+	stdCtx "context"
 	"fmt"
 	"net/http"
 	"strings"
@@ -12,8 +13,10 @@ import (
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/base"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
@@ -97,6 +100,12 @@ func prepareUserNotificationsData(ctx *context.Context) {
 		return
 	}
 	failCount += len(failures)
+	notifications, failures, err = filterNotificationsByRepoAccess(ctx, ctx.Doer, notifications)
+	if err != nil {
+		ctx.ServerError("filterNotificationsByRepoAccess", err)
+		return
+	}
+	failCount += len(failures)
 
 	failures, err = notifications.LoadIssues(ctx)
 	if err != nil {
@@ -135,6 +144,23 @@ func prepareUserNotificationsData(ctx *context.Context) {
 	ctx.Data["Page"] = pager
 }
 
+func filterNotificationsByRepoAccess(ctx stdCtx.Context, doer *user_model.User, notifications activities_model.NotificationList) (activities_model.NotificationList, []int, error) {
+	failures := make([]int, 0)
+	for i, notification := range notifications {
+		if notification.Repository == nil {
+			continue
+		}
+		perm, err := access_model.GetIndividualUserRepoPermission(ctx, notification.Repository, doer)
+		if err != nil {
+			return nil, nil, err
+		}
+		if !perm.HasAnyUnitAccessOrPublicAccess() {
+			failures = append(failures, i)
+		}
+	}
+	return notifications.Without(failures), failures, nil
+}
+
 // NotificationStatusPost is a route for changing the status of a notification
 func NotificationStatusPost(ctx *context.Context) {
 	notificationID := ctx.FormInt64("notification_id")

routers/web/user/notification_test.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package user
+
+import (
+	"testing"
+
+	activities_model "gitea.dev/models/activities"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilterNotificationsByRepoAccess(t *testing.T) {
+	require.NoError(t, unittest.LoadFixtures())
+
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
+	inaccessibleRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
+	require.True(t, inaccessibleRepo.IsPrivate)
+	accessibleRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	notifications := activities_model.NotificationList{
+		{ID: 1, Repository: inaccessibleRepo},
+		{ID: 2, Repository: accessibleRepo},
+	}
+
+	filtered, failures, err := filterNotificationsByRepoAccess(t.Context(), doer, notifications)
+	require.NoError(t, err)
+
+	assert.Equal(t, []int{0}, failures)
+	require.Len(t, filtered, 1)
+	assert.EqualValues(t, 2, filtered[0].ID)
+}