100 matches found
CVE-2026-119441
DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...
CVE-2026-118395
Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...
CVE-2026-117646
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...
CVE-2026-117685
The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...
CVE-2026-117635
The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...
CVE-2026-116289
Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119441
The Gitea application is affected by an incorrect authorization vulnerability (CWE-863) in the DELETE /api/v1/orgs/{org}/repos endpoint. The root cause is that the route failed to enforce public-only restrictions on access tokens, checking only if the organization itself was public. Consequently,...
CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...
EUVD-2026-114805
DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...
CVE-2026-118395
In Gitea 1.27.3 , a flaw allows personal access tokens restricted to public resources (public-only ) to bypass restrictions and create private resources. While the software blocked this via POST /api/v1/user/repos and POST /api/v1/repos/migrate, it remained vulnerable through POST /api/v1/org/{or...
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...
EUVD-2026-114801
The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...
CVE-2026-117685
The Gitea OCI registry contains a vulnerability where a public-only token with write:package scope can be used to mount a private package blob into a public package namespace. The root cause is an Incorrect Authorization (CWE-863) flaw where the system validates the target package against the tok...
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...
CVE-2026-117646
In Gitea , certain tabs on user profiles (repositories, stars, and watching) and organization home pages fail to validate whether a request uses a personal access token restricted to public resources (public-only). This allows a token holder to list the owner's private repositories and their star...
EUVD-2026-114798
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...