CVE-2026-119441

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

CVE-2026-118395

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

EUVD-2026-114805

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395

In Gitea 1.27.3 , a flaw allows personal access tokens restricted to public resources (public-only ) to bypass restrictions and create private resources. While the software blocked this via POST /api/v1/user/repos and POST /api/v1/repos/migrate, it remained vulnerable through POST /api/v1/org/{or...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

EUVD-2026-114803

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395: Gitea: Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories…

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-119441: Gitea: `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only…

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

PT-2026-134882

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

CVE-2026-70407

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70396

"POST /api/v1/orgs/org/repos" allows a token scoped only to "write:organization" to create repositories in an organization, even though the deprecated sibling route and other repository-creation routes also require "write:repository". A PAT or OAuth app without "write:repository" can create...

CVE-2026-52815

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/orgteam.go:8 returns all teams for any organization without requiring authentication. The route...

CVE-2026-52815: Exposure of Sensitive Information to an Unauthorized Actor

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/orgteam.go:8 returns all teams for any organization without requiring authentication. The route...