Executive brief
Gitea is an open-source platform for hosting software development projects. A security flaw allows restricted access tokens, which are supposed to only see public information, to view private organization names and membership details. This could allow a third-party tool or a compromised automation script to see internal organizational structures that should have remained hidden.
Technical details
An authorization bypass exists in Gitea's API where 'public-only' scoped Personal Access Tokens (PATs) can access private organization data. While direct access to private organizations via '/api/v1/orgs/{org}' is correctly blocked, the restriction is not consistently enforced on other endpoints. Specifically, 'GET /api/v1/user/orgs' lacks the 'checkTokenPublicOnly' middleware entirely, and 'GET /api/v1/users/{username}/orgs' fails to filter results because the middleware evaluates the path user rather than the returned organization objects. Additionally, the permissions endpoint relies on general user visibility logic rather than token-specific restrictions. This allows an attacker with a restricted token to enumerate private organization names and retrieve role information like admin status and repository creation capabilities. The issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: disclosed: External disclosure date
- 1.27.0: patched