CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443

The Gitea Git repository management system contains a vulnerability where public-only Personal Access Token (PAT) scopes can be bypassed when the owner's visibility is set to Limited (instance-internal). This issue is a residual flaw following CVE-2026-25714 (PR #37118). The root cause is that th...

CVE-2026-56443

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:43+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3 2026-08-14 21:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt32hgmbp425...