CVE-2026-50105

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2

Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lacks the repository scope to access private content, provided the account owning the token has legitimate read access to the repository. This is a token-confinement bypass that exposes private commit metadata (SHA, full message, author name, and email), private release names, notes, descriptions, private tag names, and the token owner's private activity stream.

Recommendations For Gitea version 1.26.2, implement a token-scope check in the ShowBranchFeed, ShowRepoFeed, ShowFileFeed, and ShowReleaseFeed handlers to ensure tokens are not public-only and possess the required scopes. Additionally, restrict the includePrivate logic in the user feed handler to prevent confined tokens from accessing private activity streams.