Executive brief
Gitea is an open-source forge software for hosting software development version control using Git. A vulnerability exists where security tokens intended to only access public data can be used to access internal 'Limited' visibility repositories and packages. This allows an authenticated user to bypass intended restrictions and view internal company code or software packages that should not be accessible to restricted tokens.
Technical details
A logic error in Gitea's token scope validation allows Personal Access Tokens (PATs) with the 'public-only' scope to access resources belonging to owners with 'Limited' visibility. While Gitea correctly filters 'Limited' visibility for Organization and User scopes by checking if visibility is strictly public, the Repository and Package categories only check if a resource is explicitly 'Private'. Because 'Limited' visibility (internal to the instance) is neither 'Public' nor 'Private', it falls through the check. An attacker with a restricted PAT can use it to read repository content, issues, and download packages from internal users or organizations. This was a residual issue following the fix for CVE-2026-25714 and is patched in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-05-18: other: Initial unification pass for public-only tokens merged (PR #37118)
- 2026-06-05: other: Vulnerability verified on version 1.26.2 via PoC
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: disclosed