CVE-2026-24791

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791: Incorrect Authorization

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

BIT-GITEA-2025-68941

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

GO-2025-4268 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea...

GHSA-XFQ3-QJ7J-4565 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2025-68941

CVE-2025-68941 affects Gitea prior to 1.22.3, where an API token scoped to public resources could be used to access private resources. The issue arises from mishandling access controls, enabling unauthorized disclosure from private repositories or other sensitive data. Affected components include...

EUVD-2025-205408

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2025-68941

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2025-68941

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2025-68941: Incorrect Authorization

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2025-68941

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...

CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

Decidim vulnerable to data disclosure through the embed feature

Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches version 0.27.6...

Decidim vulnerable to data disclosure through the embed feature

Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches Version 0.27.6...

CVE-2024-27090: Exposure of Sensitive Information to an Unauthorized Actor

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

CVE-2024-29900: Transmission of Private Resources into a New Sphere

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of 1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This...

CVE-2020-25032: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...