CVE-2026-56443

CVE-2026-56443 concerns a token public-only scope bypass for limited-visibility owners in Gitea, specifically affecting Repository- and Package-category endpoints. The issue appears as a residual after the CVE-2026-25714 PR #37118 unification pass, where public-only tokens that should be restrict...

GO-2026-6045 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev

Gitea: Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118 in gitea.dev...

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Summary After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT...

Tool Overload: Why MSPs Are Still Drowning with Countless Cybersecurity Tools in 2024

Highlights Complex Tool Landscape: Explore the wide array of cybersecurity tools used by MSPs, highlighting the common challenge of managing multiple systems that may overlap in functionality but lack integration. Top Cybersecurity Challenges: Discuss the main challenges MSPs face, including...

HackerOne: Report invitation links not restricted to any existing user

We recently made a change to how report invitations in order to make the Disclosure Assistance process better. Parts of this change regressed the fix we made in 123420 regarding how report invitations such as to become an external participant are handled. @japzdivino notified of this regression a...