PT-2026-63282 · Gitea+1 · Gitea+1
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Gitea version 1.26.2
Description
A bypass exists for the
public-only Personal Access Token (PAT) scope when the owner's visibility is set to Limited (instance-internal). While other scope categories correctly reject Limited owners, the Repository and Package categories only check if the resource is private, failing to account for Limited visibility. This allows a token with public-only scope to access content that should be restricted to internal users, exceeding the reach of an anonymous user.Technical details include the following affected areas:
- API Endpoints: API v1 packages, all 24 native package registries via
/api/packages/<type>/..., all API v1 Repository-category endpoints (including content, issues, PRs, releases, labels, and milestones), and web download endpoints such as/raw,/media, and/attachments, as well as LFS routes. - Vulnerable Parameters or Variables:
public-onlyPAT scope. - Function Names:
checkTokenPublicOnly(),reqPackageAccess(),TokenCanAccessRepo(), andCheckTokenScopes().
Recommendations
Update Gitea to a version where the following changes are implemented:
- In
checkTokenPublicOnly()andreqPackageAccess(), change the visibility check fromIsPrivate()to!IsPublic()for package owners. - In
TokenCanAccessRepo(), ensure the check validates that the repository owner's visibility is public whenpublic-onlyis active. - In
CheckTokenScopes(), update the logic to forbid access if the repository is private or if the owner's visibility is not public. As a temporary workaround, restrict the use of thepublic-onlyPAT scope for users accessing resources owned by accounts with Limited visibility.
Exploit
Fix
DoS
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea
Red Os