git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

CVE-2026-119627

A flaw was found in Gitea. An authenticated user possessing a restricted, public-only personal access token can bypass visibility controls when requesting user or organization web profiles and feed routes. This issue leads to information disclosure by allowing unauthorized viewers to access the...

CVE-2026-119625

A flaw was found in Gitea. The user profile web route accepts personal access tokens through HTTP Basic authentication without properly verifying their assigned permission scopes. An authenticated attacker possessing a token with limited permissions can bypass intended scope restrictions to view...

CVE-2026-116289

A flaw was found in Gitea. An authenticated attacker holding a personal access token restricted to public resources can register an organization-level Actions runner because Gitea fails to validate the token's scope properly. This issue allows the runner to receive and execute automated jobs from...

CVE-2026-119627

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-117646

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...

CVE-2026-117635

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119627

The Gitea web profile and RSS/Atom feed routes are vulnerable to information disclosure due to insufficient access control. The application fails to validate the public-only restriction of a personal access token during authentication. Consequently, a user with a public-only token can use HTTP Ba...

EUVD-2026-114808

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119625

The Gitea /{username} web route was vulnerable to an incorrect authorization issue (CWE-863) because it accepted personal access tokens via HTTP Basic authentication without verifying their scope. An attacker using a token with an unrelated scope (e.g., read:issue) could access a user's private a...

EUVD-2026-114803

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

EUVD-2026-114798

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...

EUVD-2026-114797

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

EUVD-2026-114794

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-119627: Gitea: The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a…

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

PT-2026-134885

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

PT-2026-134870

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

PT-2026-134880

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...