CVE-2026-56443

CVE-2026-56443 concerns a token public-only scope bypass for limited-visibility owners in Gitea, specifically affecting Repository- and Package-category endpoints. The issue appears as a residual after the CVE-2026-25714 PR #37118 unification pass, where public-only tokens that should be restrict...

CVE-2026-56443

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:43+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3...