CVE-2026-117635

The Gitea software contains a vulnerability where the /api/v1/admin route group fails to enforce the public-only restriction on personal access tokens. This allows a public-only token with admin scope, issued by a site administrator, to perform unauthorized actions such as listing private organiz...