CVE-2026-58431

Public-only API token restriction is not enforced on team API routes...

CVE-2026-58431

CVE-2026-58431 : Gitea fails to enforce public-only API token restrictions on team routes, enabling a token scoped to public access to retrieve private team repositories and activity metadata via /api/v1/teams/{teamid} (and related endpoints). The issue stems from improper token scope/org visibil...

CVE-2026-58431

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:11+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-h56g-4qw7-2mxg...