Alecclyde

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.26.2 **Description** A bypass exists for the `public-only` Personal Access Token (PAT) scope when the owner's visibility is set to Limited (instance-internal). While other scope categories correctly reject Limited owners, the Repository and Package categories only check if the resource is private, failing to account for Limited visibility. This allows a token with `public-only` scope to access content that should be restricted to internal users, exceeding the reach of an anonymous user. Technical details include the following affected areas: - **API Endpoints:** API v1 packages, all 24 native package registries via `/api/packages/<type>/...`, all API v1 Repository-category endpoints (including content, issues, PRs, releases, labels, and milestones), and web download endpoints such as `/raw`, `/media`, and `/attachments`, as well as LFS routes. - **Vulnerable Parameters or Variables:** `public-only` PAT scope. - **Function Names:** `checkTokenPublicOnly()`, `reqPackageAccess()`, `TokenCanAccessRepo()`, and `CheckTokenScopes()`. **Recommendations** Update Gitea to a version where the following changes are implemented: - In `checkTokenPublicOnly()` and `reqPackageAccess()`, change the visibility check from `IsPrivate()` to `!IsPublic()` for package owners. - In `TokenCanAccessRepo()`, ensure the check validates that the repository owner's visibility is public when `public-only` is active. - In `CheckTokenScopes()`, update the logic to forbid access if the repository is private or if the owner's visibility is not public. As a temporary workaround, restrict the use of the `public-only` PAT scope for users accessing resources owned by accounts with Limited visibility.