CVE-2026-70406 Gitea private comparison disclosure with public-only tokens

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-70400 Gitea private migration creation with public-only tokens

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of API requests to /api/v1/teams/id when using a public-only access token. An attacker can retrieve private team repository metadata and private team activity feed entries by sending API requests...

GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...

GHSA-XXJV-752H-3VP2 Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...

GHSA-7P4H-3GXQ-X3H3 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Summary After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

PT-2026-63298

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The /api/v1/teams/id API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these...

PT-2026-63277

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lack...