CVE-2026-70406

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The shared comparison helper fails to perform the token repository-access check during pull request updates. An attacker using a public-only token with read:repository scope can route a comparison or pull request creation through a public base repository to retrieve commit history and diffs from a private head repository that the token owner has access to. This allows the bypass of the public-only restriction of the token, although it does not bypass the account's general repository permission checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.