Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in Gitea's API allows security tokens that are supposed to be restricted to 'public-only' data to bypass these restrictions when accessing a user's own account settings. This could allow a restricted third-party application or a leaked token to modify private account resources, such as adding unauthorized SSH keys, creating private repositories, or accessing sensitive automation secrets.
Technical details
A systemic scope-boundary bypass exists in Gitea's API where the 'public-only' restriction flag on OAuth tokens and personal access tokens is not enforced for routes under the '/api/v1/user' group. While canonical endpoints like '/api/v1/users/{username}' correctly reject these tokens for private users, the self-referential routes (e.g., '/api/v1/user/keys', '/api/v1/user/repos') fail to call 'checkTokenPublicOnly()'. An attacker with a restricted token can perform unauthorized actions including adding SSH keys, creating OAuth2 applications, managing Actions secrets/runners, and enumerating private repositories. This is considered an incomplete fix for a similar issue previously tracked as CVE-2025-68941.
Affected products
- Gitea Gitea >= 1.22.3, <= 1.26.1
Timeline
- 2026-05-13: other: Vulnerability validation date
- 2026-06-14: advisory: GitHub Advisory published
- 2026-06-17: disclosed: Public disclosure date