CVE-2026-20706

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A scope escalation issue exists in the web archive download endpoint. A personal access token with any non-repository scope, such as read:issue or read:misc, can be used to download full repository archives (zip or tar.gz) of private repositories that the token owner has access to. This occurs because the Download function in routers/web/repo/repo.go fails to call checkDownloadTokenScope or CheckRepoScopedToken, allowing tokens with insufficient scopes to bypass intended restrictions. The affected endpoint is /{owner}/{private-repo}/archive/main.tar.gz.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.