CVE-2026-24059

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

CVE-2026-24791

CVE-2026-24791 affects Gitea self-hosted code.gitea.io/gitea where tokens labeled public-only can bypass private-resource restrictions on the canonical /api/v1/user self routes. Connected sources confirm the vulnerability exists in the public-only token handling for self endpoints (e.g., /api/v1/...

EUVD-2026-58127

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

EUVD-2026-58124

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58510

The CVE-2026-58510 entry relates to Gitea: the ClearRepoWatches fix was not applied to the API EditRepo path, leaving a secondary code path with stale watches when a repository’s visibility changes from public to private. Affected software: Gitea; vulnerable component: the API EditRepo/watch hand...

EUVD-2026-58123

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58511

CVE-2026-58511 describes a vulnerability in Gitea where the webhook Authorization header is returned in plaintext via the API. The root cause is described in connected sources as deficiencies in access control, enabling an attacker with sufficient privileges to potentially access or infer header ...

CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58445

CVE-2026-58445 corresponds to a Gitea vulnerability: the unscoped DeleteIssueLabel API loads a label by global ID without verifying repository/org scope, enabling a cross-repository label-ID existence/enumeration oracle. This can reveal whether arbitrary label IDs exist across the instance (inclu...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

CVE-2026-58431

CVE-2026-58431 : Gitea fails to enforce public-only API token restrictions on team routes, enabling a token scoped to public access to retrieve private team repositories and activity metadata via /api/v1/teams/{teamid} (and related endpoints). The issue stems from improper token scope/org visibil...