Executive brief
Gitea is an open-source platform for hosting software development projects. A security flaw allowed users with restricted access tokens (such as those intended only for public data or specific tasks like reading user profiles) to view the home page of private repositories they shouldn't be able to access. This could lead to the unauthorized disclosure of sensitive information, including project descriptions, file lists, and README files.
Technical details
A token scope enforcement bypass exists in Gitea's `repo.Home` handler (`GET /{owner}/{repo}`). While other web routes like archive downloads and RSS feeds correctly validate personal access tokens (PAT) or OAuth2 tokens against the required 'repository' scope using `context.CheckRepoScopedToken`, the repository home route lacks this check. An attacker with a valid token (even one scoped as 'public-only' or 'read:user') can bypass intended restrictions to view a private repository's rendered README, file/directory tree, and other metadata. This vulnerability is limited to the root view as deeper sub-paths require different authentication checks. The issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed
- 2026-07-21: advisory
- 1.27.0: patched