---
id: CVE-2026-117635
title: Gitea admin API public-only token scope bypass
summary: >-
  The `/api/v1/admin` route group did not enforce the `public-only` restriction
  of personal access tokens. A public-only token with admin scope issued by a
  site administrator could therefore list private organizations and the email
  address…
severity: none
cwe:
  - CWE-284
  - CWE-1259
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev < 28.3.0
published: '2026-11-01'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T09:48:40.375Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117635'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-37xv-m4w7-j2fh'
    label: GitHub Security Advisory GHSA-37xv-m4w7-j2fh
  - url: 'https://github.com/go-gitea/gitea/pull/39690'
    label: 'Fix: go-gitea/gitea pull request #39690'
  - url: 'https://github.com/go-gitea/gitea/pull/39853'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39853'
  - url: 'https://blog.gitea.com/release-of-28.3.0/'
    label: Gitea 28.3.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.3.0'
    label: go-gitea/gitea v28.3.0 release
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.04078
ingestedAt: '2026-11-05T18:28:50.703Z'
---

## Overview

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

## Affected

- `gitea.dev < 28.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.