CVE-2026-117646None▾ SunlitThe repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token res…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources (public-only). A holder of such a token could list the private repositories visible to the token's owner, and that user's stars and watches of private repositories. The API and the profile activity tab already applied the restriction. The impact is disclosure of repository names and metadata, not of repository content.
gitea.dev < 28.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119627NoneGitea limited-visibility profile disclosure with public-only tokens
CVE-2026-119441NoneGitea public-only token bypass on bulk organization repository deletion
CVE-2026-118395NoneGitea public-only token bypass in repository and organization creation
CVE-2026-117685NoneGitea public-only package token access to private OCI blobs
CVE-2026-118394NoneGitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-114199NoneGitea contribution heatmap private activity disclosure to public-only tokens