CVE-2026-56443

CVE-2026-56443 concerns a token public-only scope bypass for limited-visibility owners in Gitea, specifically affecting Repository- and Package-category endpoints. The issue appears as a residual after the CVE-2026-25714 PR #37118 unification pass, where public-only tokens that should be restrict...