CVE-2026-58431

Public-only API token restriction is not enforced on team API routes...

CVE-2026-58431

CVE-2026-58431 : Gitea fails to enforce public-only API token restrictions on team routes, enabling a token scoped to public access to retrieve private team repositories and activity metadata via /api/v1/teams/{teamid} (and related endpoints). The issue stems from improper token scope/org visibil...

CVE-2026-58431 Public-only API token restriction is not enforced on team API routes

Public-only API token restriction is not enforced on team API routes...

GO-2026-6059 Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

CVE-2026-34509

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...