CVE-2026-73126

Summary The Gitea Actions workflow status badge endpoint does not enforce the scope of the Personal Access Token PAT used to authenticate the request. A token that lacks "read:repository" for example one limited to "read:user", or a token explicitly restricted with "public-only", can retrieve the...