8 matches found
CVE-2026-58431
Public-only API token restriction is not enforced on team API routes...
EUVD-2026-58158
Public-only API token restriction is not enforced on team API routes...
CVE-2026-58431 Public-only API token restriction is not enforced on team API routes
Public-only API token restriction is not enforced on team API routes...
CVE-2026-58431
The Gitea application (specifically version 1.26.2 and nightly builds) contains a vulnerability where public-only API token restrictions are not properly enforced on team API routes. The root cause is that the /api/v1/teams/{teamid} route group fails to load ctx.Org.Organization, causing the chec...
SUSE CVE-2026-58431
Public-only API token restriction is not enforced on team API routes...
GO-2026-6059 Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev
Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...
PT-2026-65357
Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...
CVE-2026-34509
OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...