CVE-2026-117635None▾ SunlitThe `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email address…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
gitea.dev < 28.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119627NoneGitea limited-visibility profile disclosure with public-only tokens
CVE-2026-119441NoneGitea public-only token bypass on bulk organization repository deletion
CVE-2026-118395NoneGitea public-only token bypass in repository and organization creation
CVE-2026-117685NoneGitea public-only package token access to private OCI blobs
CVE-2026-118394NoneGitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-117646NoneGitea private repository listing to public-only tokens on profiles