CVE-2026-50105

CVE-2026-50105 affects Gitea: RSS/Atom feed handlers bypass API-token scope and public-only confinement. Root cause: feed endpoints (e.g., /{owner}/{repo}.rss, /rss/branch/*, /releases.rss, user feeds) do not enforce the repository-scoped token checks that were added for downloads, allowing token...