CVE-2026-119625 Gitea user and organization feed token scope bypass

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-119625 Gitea user and organization feed token scope bypass

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

forgejo-keys-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-keys-idor Write-up: https://abraxaslabs.tech/research/forgejo-keys-idor forgejo-keys-idor Class: IDOR Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo GET /api/v1/user/keys/id sits in the current-user group...

CVE-2026-119547

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain...

CVE-2026-119547 Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain...

EUVD-2026-113812

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain...

CVE-2026-119547

The Forgejo platform versions 15.0.11 , 16.0.0 through 16.0.7 , and 17.0.0 through 17.0.1 is vulnerable to an information disclosure flaw in the GetPublicKey API handler. The root cause is a lack of an ownership check during key lookups, allowing authenticated users with a read:user token or sess...

PT-2026-133485

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain...

CVE-2026-24059

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

EUVD-2026-58128

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

PT-2026-71699

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level...