CVE-2026-70407 Gitea organization listing token scope bypass

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70407

The Gitea organization-list API (endpoint GET /api/v1/orgs) fails to enforce the read:organization token scope. Consequently, a token with a different category, such as read:misc , can retrieve organization metadata visible to its owner. If the token belongs to a site administrator , the response...

CVE-2026-70407

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70407 Gitea organization listing token scope bypass

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70396

The Gitea organization repository-creation API suffers from an Incorrect Authorization vulnerability (CWE-863 ). While the API requires the write:organization scope, it fails to enforce the write:repository token scope required by other repository-creation routes. This allows a personal access to...

CVE-2026-70396 Gitea organization repository creation token scope bypass

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-70396 Gitea organization repository creation token scope bypass

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-66853

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

EUVD-2026-101087

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853

The Gitea user organization-list API fails to apply visibility restrictions for authenticated restricted accounts, allowing them to enumerate Limited-visibility organizations . A restricted user can list a known user's public organization memberships via the GET /api/v1/users/{username}/orgs endp...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-60010

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...

CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

EUVD-2026-101220

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-70396: Incorrect Authorization

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

PT-2026-114036

🚨 CVE-2026-110594 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically...

CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-105445

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token PAT they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then...