CVE-2026-120426

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded currentuser parameter into the file path, which the portal forwards with...

EUVD-2026-115235

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded currentuser parameter into the file path, which the portal forwards with...

CVE-2026-120426

OpenCSG CSGHub (through version v2.6.0-ce ) is vulnerable to an authorization bypass in the unauthenticated file resolve route. This flaw allows remote attackers to read private repository files, including model, code, or space repositories . The root cause is the ability for an attacker to injec...

CVE-2026-117646

In Gitea , certain tabs on user profiles (repositories, stars, and watching) and organization home pages fail to validate whether a request uses a personal access token restricted to public resources (public-only). This allows a token holder to list the owner's private repositories and their star...

CVE-2026-116289

Gitea fails to reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint. Because the resulting runner is not restricted to public repositories, an attacker possessing a write:organization token belonging to a public ...

CVE-2026-112887

In Gitea , Actions task tokens authenticate to the REST API as a shared system user with a negative ID . Because these tokens lack sufficient API scopes and filters are treated as having no owner restrictions, a user capable of running a workflow can use a job's token to perform a GET /api/v1/use...

PT-2026-134869

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-78433

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-70400 Gitea private migration creation with public-only tokens

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-70400 Gitea private migration creation with public-only tokens

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-70400 Gitea private migration creation with public-only tokens

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

EUVD-2026-101094

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

BIT-GITEA-2026-96589 Gitea private repository access retained after rejected transfer

When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70400): Gitea -- multiple vulnerabilities

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

PT-2026-114256

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-70400: Incorrect Authorization

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...