CVE-2026-70396

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-70396

The Gitea organization repository-creation API (specifically POST /api/v1/orgs/{org}/repos) is vulnerable to a token scope bypass due to incorrect authorization. While the API correctly requires the write:organization scope, it fails to enforce the write:repository scope required by other reposit...

CVE-2026-70396 Gitea organization repository creation token scope bypass

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...