CVE-2026-70407

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70396

"POST /api/v1/orgs/org/repos" allows a token scoped only to "write:organization" to create repositories in an organization, even though the deprecated sibling route and other repository-creation routes also require "write:repository". A PAT or OAuth app without "write:repository" can create...

CVE-2026-52815: Exposure of Sensitive Information to an Unauthorized Actor

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/orgteam.go:8 returns all teams for any organization without requiring authentication. The route...