CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-70406

Gitea is vulnerable to a private comparison disclosure due to the shared comparison helper omitting a necessary token repository-access check. An attacker using a public-only token with read:repository scope can bypass the token's public-only restriction by routing a comparison or pull request cr...

CVE-2026-70406 Gitea private comparison disclosure with public-only tokens

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...