CVE-2026-118395

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395

In Gitea 1.27.3 , a flaw allows personal access tokens restricted to public resources (public-only ) to bypass restrictions and create private resources. While the software blocked this via POST /api/v1/user/repos and POST /api/v1/repos/migrate, it remained vulnerable through POST /api/v1/org/{or...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

EUVD-2026-114803

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...