4189 matches found
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444
CVE-2026-58444 covers a bypass of personal access token scope enforcement on the Gitea repository home page (GET /{owner}/{repo}), which can disclose private repository contents. Affected: Gitea (open-source Git hosting) with token scope checks on repository home pages; root cause: deficiencies i...
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58429
CVE-2026-58429 affects Gitea: Public-Only Personal Access Tokens scope bypass in Organization and Permission Endpoints. Public-PAT scope bypass indicates an access-control deficiency at the organization/permission boundary, enabling a token with restricted privileges to access operations that sho...
CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
EUVD-2026-58142
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-56654
CVE-2026-56654 affects Gitea’s API where privilege escalation occurs via access token scope escalation. Concrete details in connected documents show the vulnerability class as privilege escalation through token scope manipulation in the API, enabling an attacker to gain higher privileges than int...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-56443
CVE-2026-56443 affects Gitea:Token public-only scope bypassed for Limited-visibility owners (Repositories + Package categories) due to an access-control deficiency, described as a residual issue after CVE-2026-25714 / PR #37118. The vulnerability targets the token’s public-scope handling on Limit...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
