CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126

Summary The Gitea Actions workflow status badge endpoint does not enforce the scope of the Personal Access Token PAT used to authenticate the request. A token that lacks "read:repository" for example one limited to "read:user", or a token explicitly restricted with "public-only", can retrieve the...