PT-2026-63282

CVE-2026-56443

Published

2026-07-13

Updated

2026-08-26

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2

Description A bypass exists for the public-only Personal Access Token (PAT) scope when the owner's visibility is set to Limited (instance-internal). While other scope categories correctly reject Limited owners, the Repository and Package categories only check if the resource is private, failing to account for Limited visibility. This allows a token with public-only scope to access content that should be restricted to internal users, exceeding the reach of an anonymous user.

Technical details include the following affected areas:

API Endpoints: API v1 packages, all 24 native package registries via /api/packages/<type>/..., all API v1 Repository-category endpoints (including content, issues, PRs, releases, labels, and milestones), and web download endpoints such as /raw, /media, and /attachments, as well as LFS routes.
Vulnerable Parameters or Variables: public-only PAT scope.
Function Names: checkTokenPublicOnly(), reqPackageAccess(), TokenCanAccessRepo(), and CheckTokenScopes().

Recommendations Update Gitea to a version where the following changes are implemented:

In checkTokenPublicOnly() and reqPackageAccess(), change the visibility check from IsPrivate() to !IsPublic() for package owners.
In TokenCanAccessRepo(), ensure the check validates that the repository owner's visibility is public when public-only is active.
In CheckTokenScopes(), update the logic to forbid access if the repository is private or if the owner's visibility is not public. As a temporary workaround, restrict the use of the public-only PAT scope for users accessing resources owned by accounts with Limited visibility.