CVE-2026-120426

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded currentuser parameter into the file path, which the portal forwards with...

CVE-2026-120426

OpenCSG CSGHub (through version v2.6.0-ce ) is vulnerable to an authorization bypass in the unauthenticated file resolve route. This flaw allows remote attackers to read private repository files, including model, code, or space repositories . The root cause is the ability for an attacker to injec...

EUVD-2026-115235

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded currentuser parameter into the file path, which the portal forwards with...

PT-2026-135442

Name of the Vulnerable Software and Affected Versions OpenCSG CSGHub versions prior to 2.6.0-ce Description An authorization bypass exists in the unauthenticated file resolve route. Remote attackers can read files from private model, code, or space repositories by injecting a percent-encoded...

CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded currentuser parameter into the file path, which the portal forwards with...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...

CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...

CVE-2026-117646

In Gitea , certain tabs on user profiles (repositories, stars, and watching) and organization home pages fail to validate whether a request uses a personal access token restricted to public resources (public-only). This allows a token holder to list the owner's private repositories and their star...

CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289

Gitea fails to reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint. Because the resulting runner is not restricted to public repositories, an attacker possessing a write:organization token belonging to a public ...

CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-112887 Gitea Actions task token private repository enumeration

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-112887

In Gitea , Actions task tokens authenticate to the REST API as a shared system user with a negative ID . Because these tokens lack sufficient API scopes and filters are treated as having no owner restrictions, a user capable of running a workflow can use a job's token to perform a GET /api/v1/use...

CVE-2026-112887 Gitea Actions task token private repository enumeration

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

PT-2026-134869

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

identrail authorization issue vulnerability

Versions prior to identrail 1.0.2 contain an authorization issue vulnerability. This vulnerability arises because the endpoint handling GitHub connections fails to verify whether the installationid belongs to the caller’s workspace. As a result, authenticated tenants may be able to read the priva...

CVE-2026-78433

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...