Executive brief
Gitea is an open-source platform for hosting software development projects. A security flaw was found where special 'public-only' access tokens, which are supposed to only see public information, could be used to view private team data and activity. This could lead to the unauthorized exposure of private repository names and internal team activities to users who should only have restricted access.
Technical details
An authorization bypass exists in Gitea's `/api/v1/teams/{id}` route group. The `checkTokenPublicOnly` middleware relies on `ctx.Org.Organization` to verify organization visibility; however, the `orgAssignment` call used in these routes fails to load this object, causing the check to silently pass. Furthermore, the team repository and activity feed handlers do not apply repository-level filtering or the `ApplyPublicOnly` option. An attacker with a 'public-only' scoped token can retrieve metadata for private repositories and view private activity feeds. This is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Version 1.27.0 released