CVE-2026-117685

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

EUVD-2026-114801

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

CVE-2026-117685 Gitea public-only package token access to private OCI blobs

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

CVE-2026-117685 Gitea public-only package token access to private OCI blobs

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

CVE-2026-117685

The Gitea OCI registry contains a vulnerability where a public-only token with write:package scope can be used to mount a private package blob into a public package namespace. The root cause is an Incorrect Authorization (CWE-863) flaw where the system validates the target package against the tok...

CVE-2026-117685: Gitea: The OCI registry's cross-repository blob mount checked the target package against the token's `public-only`…

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

PT-2026-134877

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

CVE-2026-78433

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

EUVD-2026-101111

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-78433): Gitea -- multiple vulnerabilities

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

PT-2026-114291

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The web attachment handler fails to perform cross-repository ownership checks for attachments created before 16 January 2026, instead validating permissions against the repository specified in...

CVE-2026-63792

"CanReadWorkflowCrossRepo" decides whether an Actions run may read a reusable workflow file referenced from another repository. Its "collaborative owner" branch grants cross-repository read through the collaborative-owner trust relationship without checking whether the run is a fork pull request...

CVE-2026-57897

A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...

ANT-2026-VN61PHA0 · gitea · IDOR

broken-authorization medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Git...

CVE-2026-58445

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58438

The Git repository management system Gitea is vulnerable to a cross-repository IDOR (Insecure Direct Object Reference) in the issue-dependency removal functionality. This flaw allows a malicious actor to tamper with and comment on private repositories they are not authorized to access. A proof-of...

CVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...