CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443

CVE-2026-56443 concerns a token public-only scope bypass for limited-visibility owners in Gitea, specifically affecting Repository- and Package-category endpoints. The issue appears as a residual after the CVE-2026-25714 PR #37118 unification pass, where public-only tokens that should be restrict...

CVE-2026-56443

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:43+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3 2026-08-14 21:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt32hgmbp425...