Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

EUVD-2026-63550

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444

CVE-2026-58444 covers a bypass of personal access token scope enforcement on the Gitea repository home page (GET /{owner}/{repo}), which can disclose private repository contents. Affected: Gitea (open-source Git hosting) with token scope checks on repository home pages; root cause: deficiencies i...

CVE-2026-58429

CVE-2026-58429 affects Gitea: Public-Only Personal Access Tokens scope bypass in Organization and Permission Endpoints. Public-PAT scope bypass indicates an access-control deficiency at the organization/permission boundary, enabling a token with restricted privileges to access operations that sho...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

CVE-2026-64652

The CVE covers GitHub CLI (gh) prior to v2.97.0, where gh auth status could reveal part of certain tokens in output. Affected tokens include fine-grained PATs (github_pat_) and GitHub App tokens (ghs_ and ghu_*), plus the Actions GITHUB_TOKEN, whenever the token format contains an underscore afte...

GO-2026-6050 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev

Gitea: Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents in gitea.dev...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

GHSA-CP3Q-VRJ2-GHHH Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

PT-2026-63283

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A privilege escalation issue exists in the API endpoint POST /users/username/tokens used for creating Personal Access Tokens. The endpoint is protected by the reqBasicOrRevProxyAuth middleware,...