CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - "GET /api/v1/user/starred" — "getStarredRepos()" computes a per-repo permission but still lists every starred repo (no filtering), so the full repo object ("full_name", "private", "clone_url", "ssh_url") of a now-inaccessible private repo is returned. - "GET /api/v1/user/times" — "ListMyTrackedTimes()" queries by "UserID" only and "LoadAttributes" brings in the issue ("title", "state"), leaking private issue titles after revocation.