GO-2026-6045 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev

Gitea: Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118 in gitea.dev...

PT-2026-63282

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A bypass exists for the public-only Personal Access Token PAT scope when the owner's visibility is set to Limited instance-internal. While other scope categories correctly reject Limited owners, the Repository...