EUVD-2026-58128

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059

CVE-2026-24059 concerns the Gitea GET endpoint /api/v1/user/actions/runners/registration-token (and its owner/repository-level equivalents). The issue is that the API scope middleware treats this GET as read-only, yet it creates a new runner registration token if none exists. A holder of a leaked...

CVE-2026-56443

CVE-2026-56443 concerns a token public-only scope bypass for limited-visibility owners in Gitea, specifically affecting Repository- and Package-category endpoints. The issue appears as a residual after the CVE-2026-25714 PR #37118 unification pass, where public-only tokens that should be restrict...

CVE-2026-50105

CVE-2026-50105 affects Gitea: RSS/Atom feed handlers bypass API-token scope and public-only confinement. Root cause: feed endpoints (e.g., /{owner}/{repo}.rss, /rss/branch/*, /releases.rss, user feeds) do not enforce the repository-scoped token checks that were added for downloads, allowing token...

CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-72564

CVE-2026-72564 affects fosrl/pangolin (through v1.20.0). An improper authorization flaw allows an authenticated attacker to reuse an access token scoped to one resource to authenticate to a different resource in another organization. The server handler authWithAccessToken.ts calls verifyResourceA...

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...

EUVD-2026-49566

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...

GO-2026-6034 Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev

Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev...

GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...

GO-2026-6045 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev

Gitea: Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118 in gitea.dev...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

GHSA-CP3Q-VRJ2-GHHH Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

EUVD-2026-41634

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data...

GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...