CVE-2026-119625

The Gitea /{username} web route was vulnerable to an incorrect authorization issue (CWE-863) because it accepted personal access tokens via HTTP Basic authentication without verifying their scope. An attacker using a token with an unrelated scope (e.g., read:issue) could access a user's private a...