CVE-2026-118395None▾ SunlitGitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/o…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Gitea 1.27.3 stopped personal access tokens restricted to public resources (public-only) from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/{org}/repos, POST /api/v1/orgs/{org}/repos, POST /api/v1/orgs and POST /api/v1/repos/{owner}/{repo}/generate still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.
gitea.dev < 28.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119627NoneGitea limited-visibility profile disclosure with public-only tokens
CVE-2026-119441NoneGitea public-only token bypass on bulk organization repository deletion
CVE-2026-117685NoneGitea public-only package token access to private OCI blobs
CVE-2026-118394NoneGitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-117646NoneGitea private repository listing to public-only tokens on profiles
CVE-2026-114199NoneGitea contribution heatmap private activity disclosure to public-only tokens