CVE-2026-24791

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791

CVE-2026-24791 affects Gitea self-hosted code.gitea.io/gitea where tokens labeled public-only can bypass private-resource restrictions on the canonical /api/v1/user self routes. Connected sources confirm the vulnerability exists in the public-only token handling for self endpoints (e.g., /api/v1/...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791

creationtimestamp| type| source ---|---|--- 2026-06-14 20:09:21+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57 2026-08-14 12:45:18+00:00| seen|...