CVE-2026-24791

🗓️ 13 Aug 2026 16:48:52Reported by GiteaType

cve🔗 web.nvd.nist.gov👁 102 Views🌐 WEB

CVE-2026-24791 allows public-only tokens to bypass private-resource restrictions on self-user API routes.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии	27 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-24791	14 Jun 202620:09	–	circl
Cvelist	CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes	13 Aug 202616:48	–	cvelist
EUVD	EUVD-2026-58127	13 Aug 202616:48	–	euvd
Github Security Blog	Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes	17 Jun 202618:09	–	github
NVD	CVE-2026-24791	13 Aug 202617:17	–	nvd
OSV	GHSA-WRR5-99H5-GQ57 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes	17 Jun 202618:09	–	osv
OSV	GO-2026-5721 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea	25 Jun 202622:34	–	osv
OSV	OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb	30 Jul 202609:09	–	osv
Positive Technologies	PT-2026-50584	17 Jun 202600:00	–	ptsecurity

[
  {
    "vendor": "Gitea",
    "product": "Gitea Open Source Git Server",
    "versions": [
      {
        "version": "1.22.3",
        "lessThanOrEqual": "1.26.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
blog	www.blog.gitea.com/release-of-1.26.2/
github	www.github.com/go-gitea/gitea/releases/tag/v1.26.2
github	www.github.com/go-gitea/gitea/pull/37118
github	www.github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57

Parameter	Position	Path	Description	CWE
token	path	/api/v1/user	Public-only tokens bypass private-resource restrictions on /api/v1/user self routes	CWE-863

26 Aug 2026 16:53Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.1

EPSS0.00251

SSVC

CWE-863