Executive brief
Gitea, a popular self-hosted Git service, contains a security flaw where access tokens with limited permissions can be used to download entire repository archives. Normally, an administrator might issue a token that only allows a user to read issues or metadata, but this bug allows that same token to bypass restrictions and download the full source code of private projects. This could lead to the unauthorized exposure of sensitive intellectual property or proprietary code.
Technical details
An improper access control vulnerability (CWE-284) exists in Gitea's web archive download endpoint (/archive/*). While other endpoints like /raw/ and /media/ were previously patched to enforce token scopes, the repo.Download function in routers/web/repo/repo.go failed to call checkDownloadTokenScope. Consequently, an attacker with a Personal Access Token (PAT) or OAuth2 token possessing any valid scope (such as read:issue or read:misc) can successfully authenticate and download full repository archives (ZIP/TAR) for private repositories they have access to, even if the token was specifically restricted from repository-level access. This bypasses the intended principle of least privilege for API and web-based tokens. The issue is resolved in Gitea version 1.26.2.
Affected products
- Gitea Gitea Open Source Git Server <= 1.26.1
Timeline
- 2026-05-16: other: Fix pull request submitted
- 2026-05-20: patched: Gitea version 1.26.2 released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-cr4g-f395-h25h published
- 2026-07-03: disclosed: CVE-2026-20706 published to NVD