CVE-2026-70407

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The organization-list API endpoint does not properly enforce the read:organization token scope. This allows a token restricted to a different category, such as read:misc, to retrieve organization metadata. In cases where a site administrator's token is used, the response may include private and Limited organizations, bypassing the intended restrictions on delegated access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.