PT-2026-50584 · Gitea+1 · Gitea+1
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea versions prior to 1.26.2
Description
Authenticated self routes under the
/api/v1/user/... group do not properly enforce the public-only token restriction. This allows a token or OAuth grant marked as public-only to access or modify private account resources, provided it possesses the required read or write scopes. This is a systemic scope-boundary bypass affecting multiple endpoints, including:/api/v1/user: Access to private profiles and settings./api/v1/user/emails: Management of account email addresses./api/v1/user/keys: Management of SSH public keys./api/v1/user/applications/oauth2: Creation and listing of OAuth2 applications, including exposure ofclient secret./api/v1/user/actions/secrets/{secretname}: Management of user-level Actions secrets./api/v1/user/actions/variables: Management of user-level Actions variables./api/v1/user/actions/runners/...: Management of runners and minting of registration tokens./api/v1/user/repos: Creation and listing of private repositories./api/v1/user/actions/runsand/api/v1/user/actions/jobs: Access to private repository workflow metadata./api/v1/user/subscriptions,/api/v1/user/times,/api/v1/user/stopwatches,/api/v1/user/teams, and/api/v1/user/hooks: Access to private account resources.
Recommendations
Update Gitea to version 1.26.2 or later.
As a temporary mitigation, restrict the issuance of tokens with
write:user or write:repository scopes to only trusted entities to minimize the risk of unauthorized private resource modification.Exploit
Fix
DoS
Improper Access Control
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitea
Red Os